Stay Secure with the Latest Linux Advisories

security advisoryfedoraupdate

Fedora 33: 2021-508acb1153 Severe Lasso XML Signature Wrapping

CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-508acb1153 2021-06-11 01:18:48.291794 --------------------------------------------------------------------------------Name : lasso Product : Fedora 33 Version : 2.7.0 Release : 1.fc33 URL : https://lasso.entrouvert.org/ Summary : Liberty Alliance Single Sign On Description : Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages. --------------------------------------------------------------------------------Update Information: CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses --------------------------------------------------------------------------------ChangeLog: * Wed Jun 2 2021 Jakub Hrozek - 2.7.0 - Lasso 2.7.0 - https://listes.entrouvert.com/arc/lasso/2021-06/msg00000.html - don't package java bindings as they are not maintained upstream anymore and there seem to be no users - Resolves: rhbz#1966607 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses * Sun May 23 2021 Jitka Plesnikova - 2.6.1-9 - Perl 5.34 rebuild * Tue Jan 26 2021 Fedora Release Engineering - 2.6.1-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild * Thu Aug 13 2020 Jakub Hrozek - 2.6.1-7 - Temporarily build with OpenJDK 8 - upstream ticket for OpenJDK11 support: https://dev.entrouvert.org/issues/45876 * Fri Aug 7 2020 Jeff Law - 2.6.1-6 - Revert last change. I lost the patchfile and I can't reproduce the gcc-11 problem which almost certainly prompted it * Fri Aug 7 2020 Jeff Law - 2.6.1-5 - Fix format string problem * Sat Aug 1 2020 FedoraRelease Engineering - 2.6.1-4 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Tue Jul 28 2020 Fedora Release Engineering - 2.6.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Fri Jul 10 2020 Jiri Vanek - 2.6.1-2 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 --------------------------------------------------------------------------------References: [ 1 ] Bug #1940089 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses https://bugzilla.redhat.com/show_bug.cgi?id=1940089 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-508acb1153' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure . Important patch for Lasso in Fedora 33 resolving XML signature wrapping vulnerabilities in SAML assertions.. Lasso Update, XML Signature Issue, Fedora Security, SAML Vulnerability. . Severity: Critical. LinuxSecurity.com Team

Jun 10, 2021 •Critical Fedora