UBUNTU-CVE-2021-33054

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)

References

Affected packages

Ubuntu:Pro:16.04:LTS / sogo

Package

Name: sogo
Purl: pkg:deb/ubuntu/sogo?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2.17a-1.1ubuntu0.1~esm1

Affected versions

2.*

2.2.17a-1

2.2.17a-1.1

2.2.17a-1.1build1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "sogo",
            "binary_version": "2.2.17a-1.1ubuntu0.1~esm1"
        },
        {
            "binary_name": "sogo-common",
            "binary_version": "2.2.17a-1.1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-33054.json"

Ubuntu:Pro:18.04:LTS / sogo

Package

Name: sogo
Purl: pkg:deb/ubuntu/sogo?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.10-1ubuntu0.1~esm1

Affected versions

3.*

3.2.10-1

3.2.10-1build1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "sogo",
            "binary_version": "3.2.10-1ubuntu0.1~esm1"
        },
        {
            "binary_name": "sogo-common",
            "binary_version": "3.2.10-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-33054.json"

Ubuntu:Pro:20.04:LTS / sogo

Package

Name: sogo
Purl: pkg:deb/ubuntu/sogo?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.3.0-1ubuntu0.1~esm1

Affected versions

4.*

4.0.8-1

4.1.0-1

4.1.1-1

4.3.0-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "sogo",
            "binary_version": "4.3.0-1ubuntu0.1~esm1"
        },
        {
            "binary_name": "sogo-common",
            "binary_version": "4.3.0-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-33054.json"