Vulnerability CVE-2021-33054: Information
Description
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| sogo | sisyphus | 5.1.1-alt1 | 5.10.0-alt1 | ALT-PU-2021-1970-1 | 273362 | Fixed |
| sogo | p10 | 5.1.1-alt1 | 5.9.1-alt1 | ALT-PU-2021-1970-1 | 273362 | Fixed |
| sogo | c10f1 | 5.1.1-alt1 | 5.9.1-alt1 | ALT-PU-2021-1970-1 | 273362 | Fixed |
| sogo | c9f2 | 5.0.0-alt1.c9f2.1 | 5.0.0-alt1.c9f2.1 | ALT-PU-2022-1952-1 | 300616 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md |
|
| https://www.sogo.nu/news.html |
|
| https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html |
|
| [debian-lts-announce] 20210712 [SECURITY] [DLA 2707-1] sogo security update |
|
| DSA-5029 |
|