Critical Security Update for Lasso Package: Type Confusion Vulnerability
Summary
ALSA-2025:21462: Critical: lasso security update. Affects lasso versions < 2.7.0-11.el9_7.3. Fixed in 2.7.0-11.el9_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Lasso package is a library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It facilitates the management of SAML-based federations and provides bindings for various programming languages. This package is essential for applications that require secure authentication and authorization mechanisms. However, it has been identified to have a critical vulnerability that could compromise its security features.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47151, is a type confusion issue within the Entr'ouvert Lasso library. This flaw can potentially allow an attacker to manipulate the application's behavior, leading to unauthorized access or data leakage. The vulnerability arises from improper handling of data types, which can be exploited to execute arbitrary code or escalate privileges within the application.
How To Fix
Minimum fixed version
2.7.0-11.el9_7.3
This is the first release that contains the fix.
sudo dnf update lassoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider restricting access to the affected application or implementing additional security layers to mitigate potential exploitation until the update can be applied.
Conclusion
The Lasso package has a critical vulnerability that needs immediate attention. By updating to the latest patched version, users can protect their applications from potential exploitation. It is crucial to stay informed about such vulnerabilities to ensure the security and integrity of your software.
See every vulnerability recorded for lasso →
FAQ
CVE-2025-47151 is a critical vulnerability in the Lasso library that involves type confusion, potentially allowing attackers to exploit the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access, data leakage, or even remote code execution within the application.
Yes, a patch is available in version 2.7.0-11.el9_7.3 of the Lasso package. It is recommended to update to this version.
If immediate updates are not possible, consider implementing additional security measures or restricting access to the affected application until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for lasso.
