[RHSA-2021:4325-03] Moderate: lasso security and enhancement update

Tue Nov 9 20:46:16 UTC 2021

An update for lasso is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux CRB (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

The lasso packages provide the Lasso library that implements the Liberty
Alliance Single Sign-On standards, including the SAML and SAML2
specifications. It allows handling of the whole life-cycle of SAML-based
federations and provides bindings for multiple languages.

Security Fix(es):

* lasso: XML signature wrapping vulnerability when parsing SAML responses
(CVE-2021-28091)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1829785 - [RFE] lasso-devel is not shipped with AppStream. Solution: Add the RPM to CRB.
1940089 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
lasso-2.6.0-12.el8.src.rpm

aarch64:
java-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm
lasso-2.6.0-12.el8.aarch64.rpm
lasso-debuginfo-2.6.0-12.el8.aarch64.rpm
lasso-debugsource-2.6.0-12.el8.aarch64.rpm
perl-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm
python3-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm

ppc64le:
java-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm
lasso-2.6.0-12.el8.ppc64le.rpm
lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm
lasso-debugsource-2.6.0-12.el8.ppc64le.rpm
perl-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm
python3-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm

s390x:
java-lasso-debuginfo-2.6.0-12.el8.s390x.rpm
lasso-2.6.0-12.el8.s390x.rpm
lasso-debuginfo-2.6.0-12.el8.s390x.rpm
lasso-debugsource-2.6.0-12.el8.s390x.rpm
perl-lasso-debuginfo-2.6.0-12.el8.s390x.rpm
python3-lasso-debuginfo-2.6.0-12.el8.s390x.rpm

x86_64:
java-lasso-debuginfo-2.6.0-12.el8.i686.rpm
java-lasso-debuginfo-2.6.0-12.el8.x86_64.rpm
lasso-2.6.0-12.el8.i686.rpm
lasso-2.6.0-12.el8.x86_64.rpm
lasso-debuginfo-2.6.0-12.el8.i686.rpm
lasso-debuginfo-2.6.0-12.el8.x86_64.rpm
lasso-debugsource-2.6.0-12.el8.i686.rpm
lasso-debugsource-2.6.0-12.el8.x86_64.rpm
perl-lasso-debuginfo-2.6.0-12.el8.i686.rpm
perl-lasso-debuginfo-2.6.0-12.el8.x86_64.rpm
python3-lasso-debuginfo-2.6.0-12.el8.i686.rpm
python3-lasso-debuginfo-2.6.0-12.el8.x86_64.rpm

Red Hat Enterprise Linux CRB (v. 8):

aarch64:
java-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm
lasso-debuginfo-2.6.0-12.el8.aarch64.rpm
lasso-debugsource-2.6.0-12.el8.aarch64.rpm
lasso-devel-2.6.0-12.el8.aarch64.rpm
perl-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm
python3-lasso-debuginfo-2.6.0-12.el8.aarch64.rpm

ppc64le:
java-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm
lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm
lasso-debugsource-2.6.0-12.el8.ppc64le.rpm
lasso-devel-2.6.0-12.el8.ppc64le.rpm
perl-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm
python3-lasso-debuginfo-2.6.0-12.el8.ppc64le.rpm

s390x:
java-lasso-debuginfo-2.6.0-12.el8.s390x.rpm
lasso-debuginfo-2.6.0-12.el8.s390x.rpm
lasso-debugsource-2.6.0-12.el8.s390x.rpm
lasso-devel-2.6.0-12.el8.s390x.rpm
perl-lasso-debuginfo-2.6.0-12.el8.s390x.rpm
python3-lasso-debuginfo-2.6.0-12.el8.s390x.rpm

x86_64:
java-lasso-debuginfo-2.6.0-12.el8.i686.rpm
java-lasso-debuginfo-2.6.0-12.el8.x86_64.rpm
lasso-debuginfo-2.6.0-12.el8.i686.rpm
lasso-debuginfo-2.6.0-12.el8.x86_64.rpm
lasso-debugsource-2.6.0-12.el8.i686.rpm
lasso-debugsource-2.6.0-12.el8.x86_64.rpm
lasso-devel-2.6.0-12.el8.i686.rpm
lasso-devel-2.6.0-12.el8.x86_64.rpm
perl-lasso-debuginfo-2.6.0-12.el8.i686.rpm
perl-lasso-debuginfo-2.6.0-12.el8.x86_64.rpm
python3-lasso-debuginfo-2.6.0-12.el8.i686.rpm
python3-lasso-debuginfo-2.6.0-12.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-28091
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYYreGNzjgjWX9erEAQhu6Q/8DGtT8qgSNw36x4ikGRMBTQVS2+Tt0M+P
Bzf52q88f2PWlmgrxkg/986iryFXjL2qhnU9auBQvdnzuUP6n1PShmJX14knCLpI
47RfCU4fa+hZUUhIpnHbia0IzXxNNWgSBLiC7pSW5aJ5h2CBCIxtrMSxWY30Ahpl
faSh/gVjG9o2AVnn04LBv0AfGMQKHAWhLfmQTbw+VTaqmazdRDJlIslKbbkCg9ma
+alJT50qNQhaexqren0+eMeis1CTp0EWT+/rN36fp4s9o8sFKBc7efa3burcY0Mu
3JRd/23RMaxsMCuIJx9Yy/wkriHJjVhKD/37nhyB+TnPnqehg3YWklsoWCgo60xi
vou7sARDc/zQUowkdgWQt4Y/W5c07aoHYhk9oXIlKNvI6Hta2n5gc6NrEA2VlsBB
TDpmeUKLfXpSU8HlRqfEt1WMJsK0Kdx7l9yc1Y+DwpjWWkdvZiY9I12zxqcEG/Ll
FINC1IDNiq4T4L+TGM+chQsH5TYtZKgZndEb/7lNwLRU2h4HaE1vMnj0wut9l9Bc
amM4/QexfOSZCPHUjq33x84djuboCgphZr4A3LObqbcsIOwQY6KghWIhTjJOWXEA
K+tkva4Qzt4qEStsR8uJldVwtSykrjBHI+qNPUv6hME299MzajzJezDeMDshuecR
1p4X6dluS9s=
=onUJ
-----END PGP SIGNATURE-----