lasso-2.6.0-12.el8

エラータID: AXSA:2021-2745:02

Release date: 
Tuesday, December 14, 2021 - 02:45
Subject: 
lasso-2.6.0-12.el8
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
Moderate
Description: 

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages.

Security Fix(es):

* lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2021-28091
Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

Solution: 

Update packages.

CVEs: 
CVE-2021-28091
Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.
Additional Info: 

N/A

Download: 

SRPMS
  1. lasso-2.6.0-12.el8.src.rpm
    MD5: 4fb4a294789ba8a0314ce145030d0e44
    SHA-256: 3acb5671e660f6aa6af82ea4a961b60cd5450bbf36501bfbddb843c4882416cf
    Size: 4.25 MB

Asianux Server 8 for x86_64
  1. lasso-2.6.0-12.el8.x86_64.rpm
    MD5: 689eba8010ec3b7b9d9e22eb3eb1e68f
    SHA-256: 3da4a8bf1a045fbdc58c2b8fbfce6ec0e01c042d3c0e1261dc8d7cf476d92a1d
    Size: 205.34 kB
  2. lasso-2.6.0-12.el8.i686.rpm
    MD5: df0dbbfc4103b243eeb9cc6b5d13085f
    SHA-256: 01c58ef21ec8af8352a0b7a974ddd14e854c0307bc0b00b0bf9d895e260622cf
    Size: 218.00 kB