SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
References
Link | Resource |
---|---|
https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html | Third Party Advisory |
https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md | Release Notes Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2021/07/msg00007.html | Mailing List Third Party Advisory |
https://www.debian.org/security/2021/dsa-5029 | Third Party Advisory |
https://www.sogo.nu/news.html | Product |
Configurations
History
29 Mar 2022, 16:38
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
|
References | (DEBIAN) https://www.debian.org/security/2021/dsa-5029 - Third Party Advisory |
23 Dec 2021, 13:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
02 Dec 2021, 13:55
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
10 Jun 2021, 13:49
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:inverse:sogo:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
CWE | CWE-347 | |
References | (MISC) https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md - Release Notes, Third Party Advisory | |
References | (MISC) https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html - Third Party Advisory | |
References | (MISC) https://www.sogo.nu/news.html - Product |
04 Jun 2021, 15:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-06-04 15:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-33054
Mitre link : CVE-2021-33054
CVE.ORG link : CVE-2021-33054
JSON object : View
Products Affected
inverse
- sogo
debian
- debian_linux
CWE
CWE-347
Improper Verification of Cryptographic Signature