UbuntuUpdates.org

Package "lasso"

Name: lasso

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Library for Liberty Alliance and SAML protocols - Perl bindings
  • Library for Liberty Alliance and SAML protocols - Python bindings
Latest version: 2.7.0-2ubuntu0.1
Release: jammy (22.04)
Level: security
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "lasso" in Jammy

Repository Area Version
base main 2.7.0-2build3
base universe 2.7.0-2build3
security main 2.7.0-2ubuntu0.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.7.0-2ubuntu0.1 2025-11-18 19:07:09 UTC

  lasso (2.7.0-2ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS in lasso_provider_verify_saml_signature
    - debian/patches/CVE-2025-46404.patch: check xmlSecGetNodeNsHref for
      possible NULL result in lasso/id-ff/provider.c.
    - CVE-2025-46404
  * SECURITY UPDATE: DoS in g_assert_not_reached
    - debian/patches/CVE-2025-46705-pre1.patch: test that inserted comment
      do not change node value in bindings/python/tests/profiles_tests.py,
      lasso/xml/xml.c.
    - debian/patches/CVE-2025-46705.patch: do not terminate on an unknown
      XML node type in lasso/xml/xml.c.
    - CVE-2025-46705
  * SECURITY UPDATE: DoS in lasso_node_init_from_message_with_format
    - debian/patches/CVE-2025-46784-1.patch: add new define
      LASSO_XMLSEC_VERSION_NUMBER allow version check on libxmlsec in
      configure.ac.
    - debian/patches/CVE-2025-46784-2.patch: make lasso_inflate output the
      inflated buffer size in lasso/xml/tools.c.
    - debian/patches/CVE-2025-46784-3.patch: adapt lasso_base64_decode to
      the deprecation of xmlSecBase64Decode in lasso/xml/tools.c.
    - debian/patches/CVE-2025-46784-4.patch: replace all use of
      xmlSecBase64Decode by lasso_base64_decode in lasso/id-ff/login.c,
      lasso/id-ff/provider.c, lasso/id-ff/session.c,
      lasso/saml-2.0/profile.c, lasso/xml/tools.c, lasso/xml/xml.c.
    - CVE-2025-46784
  * SECURITY UPDATE: type confusion issue in lasso_node_impl_init_from_xml
    - debian/patches/CVE-2025-47151.patch: prevent assignment of attribute
      value inside any attribute in lasso/xml/misc_text_node.c,
      lasso/xml/saml-2.0/saml2_attribute_value.c, lasso/xml/xml.c.
    - CVE-2025-47151

 -- Marc Deslauriers <email address hidden> Mon, 17 Nov 2025 09:15:05 -0500
CVE-2025-46404 A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr&#39;ouvert Lasso 2.5.1. A specially crafte
CVE-2025-46705 A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML
CVE-2025-46784 A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr&#39;ouvert Lasso 2.5.1. A specially cr
CVE-2025-47151 A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially crafte


About   -   Send Feedback to @ubuntu_updates