Vulnerability · Published Jun 4, 2021 · Assigned by mitre
CVE-2021-28091
High 7.5
In plain English
A high-severity security flaw in the lasso package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.4%top 27.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | lasso | 2.6.0-12.el8 | ALSA-2021:4325 |
| AlmaLinux:8 | lasso-devel | 2.6.0-12.el8 | ALSA-2021:4325 |
| Debian:12 | lasso | 2.6.1-3 | DEBIAN-CVE-2021-28091 |
| Debian:13 | lasso | 2.6.1-3 | DEBIAN-CVE-2021-28091 |
| Debian:14 | lasso | 2.6.1-3 | DEBIAN-CVE-2021-28091 |
| Rocky Linux:8 | lasso | 0:2.6.0-12.el8 | RLSA-2021:4325 |
Affected products (as reported)
References
- http://listes.entrouvert.com/arc/lasso/ x_refsource_MISC
- https://git.entrouvert.org/lasso.git/commit/?id=076a37d7f0eb74001127481da2d355683693cde9 x_refsource_MISC
- https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0 x_refsource_MISC
- DSA-4926 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20210610 [SECURITY] [DLA 2684-1] lasso security update mailing-list, x_refsource_MLIST
- FEDORA-2021-bb3ea1e191 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-508acb1153 vendor-advisory, x_refsource_FEDORA