Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Red Hat Enterprise Linux 8 RHSA-2021-4325-01 Moderate Lasso Security Patch

red hat
Calendar Grey November 9, 2021
Dist Redhat Esm H88
Recent lasso update from Red Hat improves security measures. Features crucial patches for vulnerabilities in XML parsing issues.
An update for lasso is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

1940089 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses

Summary

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages.
Security Fix(es):
* lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory moderate update Red Hat Enterprise Linux security patch lasso XML signature

References

https://access.redhat.com/security/cve/CVE-2021-28091 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.5_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: lasso-2.6.0-12.el8.src.rpm
aarch64: java-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm lasso-2.6.0-12.el8.aarch64.rpm lasso-debuginfo-2.6.0-12.el8.aarch64.rpm lasso-debugsource-2.6.0-12.el8.aarch64.rpm perl-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm python3-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm
ppc64le: java-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm lasso-2.6.0-12.el8.ppc64le.rpm lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm lasso-debugsource-2.6.0-12.el8.ppc64le.rpm perl-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm python3-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm
s390x: java-lasso-debuginfo-2.6.0-12.el8.s390x.rpm lasso-2.6.0-12.el8.s390x.rpm lasso-debuginfo-2.6.0-12.el8.s390x.rpm lasso-debugsource-2.6.0-12.el8.s390x.rpm perl-lasso-debuginfo-2.6.0-12.el8.s390x.rpm python3-lasso-debuginfo-2.6.0-12.el8.s390x.rpm
x86_64: java-lasso-debuginfo-2.6.0-12.el8.i686.rpm java-lasso-debuginfo-2.6.0-12.el8.x86_64.rpm lasso-2.6.0-12.el8.i686.rpm lasso-2.6.0-12.el8.x86_64.rpm lasso-debuginfo-2.6.0-12.el8.i686.rpm lasso-debuginfo-2.6.0-12.el8.x86_64.rpm lasso-debugsource-2.6.0-12.el8.i686.rpm lasso-debugsource-2.6.0-12.el8.x86_64.rpm perl-lasso-debuginfo-2.6.0-12.el8.i686.rpm perl-lasso-debuginfo-2.6.0-12.el8.x86_64.rpm

Read the Full Advisory


Advisory ID: RHSA-2021:4325-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4325
Issue date: 2021-11-09

Topic

An update for lasso is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate update Red Hat Enterprise Linux security patch lasso XML signature

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux CRB (v. 8) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here