USN-4974-1: Lasso vulnerability
2 June 2021
Applications using Lasso could be made to allow unintended access.
- lasso - Liberty Alliance and SAML protocol Library
It was discovered that Lasso did not properly verify that all
assertions in a SAML response were properly signed. An attacker
could possibly use this to impersonate users or otherwise bypass
The problem can be corrected by updating your system to the following package versions:
After a standard system update you need to restart applications that use
Lasso to make all the necessary changes.