Critical Security Update for Lasso Package: Type Confusion Vulnerability
Summary
ALSA-2025:21628: Critical: lasso security update. Affects lasso versions < 2.6.0-14.el8_10. Fixed in 2.6.0-14.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Lasso package provides a library that implements the Liberty Alliance Single Sign-On standards, including SAML and SAML2 specifications. It facilitates the management of SAML-based federations and offers bindings for various programming languages. This package is crucial for applications that require secure single sign-on capabilities, making it a target for vulnerabilities that could compromise security.
Vulnerability Detail
The vulnerability identified as CVE-2025-47151 is a type confusion issue in the Entr'ouvert Lasso library. This flaw can lead to unexpected behavior in the application, potentially allowing an attacker to exploit the confusion to execute arbitrary code or gain unauthorized access to sensitive information. The impact of this vulnerability is critical, as it undermines the security protocols that the Lasso library is designed to uphold.
How To Fix
Minimum fixed version
2.6.0-14.el8_10
This is the first release that contains the fix.
sudo dnf update lassoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling features that utilize the Lasso library until the package can be updated. However, this is not a long-term solution and should only be used if absolutely necessary.
Conclusion
The Lasso package has a critical vulnerability that requires immediate attention. By updating to the latest version, users can protect their applications from potential exploitation. Regular monitoring and updates are essential in maintaining security.
See every vulnerability recorded for lasso →
FAQ
CVE-2025-47151 is a critical vulnerability in the Lasso library that involves type confusion, which can lead to security breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could result in unauthorized access to sensitive data and potential exploitation of your application.
Yes, if exploited, this vulnerability could lead to data breaches, which may result in data loss or theft.
It is recommended to regularly check for updates and apply security patches as soon as they are available to minimize risks.
Related vulnerabilities
Recent vulnerabilities recorded for lasso.
