| Name | CVE-2021-33054 |
| Description | SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.) |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2707-1, DSA-5029-1 |
| Debian Bugs | 989479 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| sogo (PTS) | stretch (security), stretch (lts), stretch | 3.2.6-2+deb9u1 | fixed |
| buster (security), buster, buster (lts) | 4.0.7-1+deb10u2 | fixed | |
| bullseye (security), bullseye | 5.0.1-4+deb11u1 | fixed | |
| bookworm | 5.8.0-1 | fixed | |
| sid, trixie | 5.11.2-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| sogo | source | stretch | 3.2.6-2+deb9u1 | DLA-2707-1 | ||
| sogo | source | buster | 4.0.7-1+deb10u2 | DSA-5029-1 | ||
| sogo | source | bullseye | 5.0.1-4+deb11u1 | DSA-5029-1 | ||
| sogo | source | (unstable) | 5.1.1-1 | 989479 |
https://www.sogo.nu/news/2021/saml-vulnerability.html
https://blogs.akamai.com/2021/06/saml-implementation-vulnerability-impacting-some-akamai-services.html
https://blogs.akamai.com/2021/06/akamai-eaa-impersonation-vulnerability---a-deep-dive.html
https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html
Introduced by: https://github.com/inverse-inc/sogo/commit/5487f34b9ee9b9639e3f1d4a7abf4fad2d240d66 (SOGo-2.0.5)
Fixed by: https://github.com/inverse-inc/sogo/commit/e53636564680ac0df11ec898304bc442908ba746 (SOGo-5.1.1)
CVE is assigned for the SOGo vulnerability regarding the lasso usage.