A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade lassoUpgrade python3-lassoUpgrade lasso-devel | Nov 20, 2025 | Nov 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python3-lassoUpgrade lasso-debuginfoUpgrade lasso-develUpgrade lasso | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade perl-lasso-debuginfoUpgrade python3-lassoUpgrade python3-lasso-debuginfoUpgrade lasso-debugsourceUpgrade lasso-develUpgrade lasso-debuginfoUpgrade perl-lassoUpgrade lasso | Nov 11, 2025 | Nov 5, 2025 |
| Debian | — | Upgrade lasso | Nov 17, 2025 | Nov 17, 2025 |
| Oracle_linux | — | Upgrade lasso-pythonUpgrade lasso-develUpgrade lassoUpgrade python3-lasso | Nov 21, 2025 | Nov 5, 2025 |
| Redhat_linux | — | Upgrade perl-lasso-debuginfoUpgrade lasso-debugsourceUpgrade java-lasso-debuginfoUpgrade python3-lassoUpgrade python3-lasso-debuginfoUpgrade lassoUpgrade lasso-pythonUpgrade lasso-debuginfoUpgrade lasso-develNo solution exists | Nov 18, 2025 | Nov 5, 2025 |
| Rocky_linux | — | Upgrade python3-lasso-debuginfoUpgrade lasso-develUpgrade lasso-debuginfoUpgrade lassoUpgrade python3-lassoUpgrade lasso-debugsource | Feb 5, 2026 | Nov 18, 2025 |
| Suse | — | Upgrade python3-lassoUpgrade liblasso-develUpgrade liblasso3 | Dec 5, 2025 | Nov 12, 2025 |
| Ubuntu | — | Upgrade python3-lassoUpgrade liblasso3Upgrade liblasso-perlUpgrade liblasso3t64 | Nov 19, 2025 | Nov 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub