Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has lasso packages installed that are affected by a vulnerability:

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has lasso packages installed that are affected by a vulnerability:

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4325 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4325 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4325 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4325 advisory.

  - lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4325 advisory.

  - lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the lasso packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the lasso package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the lasso packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Lasso all versions prior to 2.7.0 has improper     verification of a cryptographic     signature.(CVE-2021-28091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of lasso installed on the remote host is prior to 2.5.1-8.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1529 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2989 advisory.

  - lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2989-1 advisory.

  - lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2589-1 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2989 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1057-1 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of lasso installed on the remote host is prior to 2.5.1-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1660 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability was discovered in lasso, a library for Liberty Alliance and SAML protocols, which results to a improper verification of a cryptographic signature.

For Debian 9 stretch, this problem has been fixed in version 2.5.0-5+deb9u1.

We recommend that you upgrade your lasso packages.

For the detailed security status of lasso please refer to its security tracker page at: https://security-tracker.debian.org/tracker/lasso

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

entrouvert reports :

When AuthnResponse messages are not signed (which is permitted by the specifiation), all assertion's signatures should be checked, but currently after the first signed assertion is checked all following assertions are accepted without checking their signature, and the last one is considered the main assertion.

It was discovered that lasso, a library which implements SAML 2.0 and Liberty Alliance standards, did not properly verify that all assertions in a SAML response were properly signed, allowing an attacker to impersonate users or bypass access control.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4974-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
160822	NewStart CGSL CORE 5.05 / MAIN 5.05 : lasso Vulnerability (NS-SA-2022-0046)	Nessus	NewStart CGSL Local Security Checks	high
160752	NewStart CGSL CORE 5.04 / MAIN 5.04 : lasso Vulnerability (NS-SA-2022-0011)	Nessus	NewStart CGSL Local Security Checks	high
157761	Rocky Linux 8 : lasso (RLSA-2021:4325)	Nessus	Rocky Linux Local Security Checks	high
157521	AlmaLinux 8 : lasso (ALSA-2021:4325)	Nessus	Alma Linux Local Security Checks	high
155389	Oracle Linux 8 : lasso (ELSA-2021-4325)	Nessus	Oracle Linux Local Security Checks	high
155072	RHEL 8 : lasso (RHSA-2021:4325)	Nessus	Red Hat Local Security Checks	high
155028	CentOS 8 : lasso (CESA-2021:4325)	Nessus	CentOS Local Security Checks	high
154385	EulerOS 2.0 SP3 : lasso (EulerOS-SA-2021-2589)	Nessus	Huawei Local Security Checks	high
153640	EulerOS 2.0 SP8 : lasso (EulerOS-SA-2021-2467)	Nessus	Huawei Local Security Checks	high
153354	EulerOS 2.0 SP2 : lasso (EulerOS-SA-2021-2393)	Nessus	Huawei Local Security Checks	high
153162	Amazon Linux AMI : lasso (ALAS-2021-1529)	Nessus	Amazon Linux Local Security Checks	high
153078	EulerOS 2.0 SP5 : lasso (EulerOS-SA-2021-2337)	Nessus	Huawei Local Security Checks	high
152355	RHEL 7 : lasso (RHSA-2021:2989)	Nessus	Red Hat Local Security Checks	high
152192	Scientific Linux Security Update : lasso on SL7.x i686/x86_64 (2021:2989)	Nessus	Scientific Linux Local Security Checks	high
152187	SUSE SLED12 / SLES12 Security Update : lasso (SUSE-SU-2021:2589-1)	Nessus	SuSE Local Security Checks	high
152177	Oracle Linux 7 : lasso (ELSA-2021-2989)	Nessus	Oracle Linux Local Security Checks	high
151822	openSUSE 15 Security Update : lasso (openSUSE-SU-2021:1057-1)	Nessus	SuSE Local Security Checks	high
150964	Amazon Linux 2 : lasso (ALAS-2021-1660)	Nessus	Amazon Linux Local Security Checks	high
150703	Debian DLA-2684-1 : lasso security update	Nessus	Debian Local Security Checks	high
150316	FreeBSD : lasso -- signature checking failure (417de1e6-c31b-11eb-9633-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	high
150310	Debian DSA-4926-1 : lasso - security update	Nessus	Debian Local Security Checks	high
150134	Ubuntu 18.04 LTS / 20.04 LTS : Lasso vulnerability (USN-4974-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-28091

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high