Your submission was sent successfully! Close

USN-4974-1: Lasso vulnerability

2 June 2021

Applications using Lasso could be made to allow unintended access.



  • lasso - Liberty Alliance and SAML protocol Library


It was discovered that Lasso did not properly verify that all
assertions in a SAML response were properly signed. An attacker
could possibly use this to impersonate users or otherwise bypass
access controls.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.04
Ubuntu 20.10
Ubuntu 20.04
Ubuntu 18.04

After a standard system update you need to restart applications that use
Lasso to make all the necessary changes.