2022-05-28
ALT-BU-2022-5082-1
Branch c9f2 update bulletin.
Closed vulnerabilities
Published: 2021-06-04
BDU:2021-04894
Уязвимость метода аутентификации программного обеспечения для совместной работы SOGo, связанная с некорректным подтверждением криптографической подписи данных, позволяющая нарушителю оказать воздействие на целостность данных
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
Published: 2021-06-04
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-33054
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
- https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html
- https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html
- https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md
- https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md
- [debian-lts-announce] 20210712 [SECURITY] [DLA 2707-1] sogo security update
- [debian-lts-announce] 20210712 [SECURITY] [DLA 2707-1] sogo security update
- DSA-5029
- DSA-5029
- https://www.sogo.nu/news.html
- https://www.sogo.nu/news.html