openSUSE-SU-2025:20083-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2025:20083-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2025:20083-1

Upstream

CVE (3)

Related

CVE (3)

Published

2025-11-25T13:27:21Z

Modified

2026-03-23T04:54:16Z

Summary

Security update for lasso

Details

This update for lasso fixes the following issues:

CVE-2025-46404: specially crafted SAML response can lead to a denial of service (bsc#1253092).
CVE-2025-46705: specially crafted SAML assertion response can lead to a denial of service (bsc#1253093).
CVE-2025-47151: type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality can lead to an arbitrary code execution (bsc#1253095).

References

Affected packages

openSUSE:Leap 16.0 / lasso

Package

Name: lasso
Purl: pkg:rpm/opensuse/lasso&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.8.2-160000.3.1

Ecosystem specific

{
    "binaries":  [
        {
            "liblasso-devel":  "2.8.2-160000.3.1",
            "liblasso3":  "2.8.2-160000.3.1",
            "python3-lasso":  "2.8.2-160000.3.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2025:20083-1.json"