The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:21628 advisory.

    * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:21462 advisory.

    * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-21628 advisory.

    [2.6.0-14]
    - Fixing CVE-2025-47151       Resolves: RHEL-126687 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of lasso installed on the remote host is prior to 2.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3077 advisory.

    A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of     Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An     attacker can send a malformed SAML response to trigger this vulnerability. (CVE-2025-46404)

    A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert     Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An     attacker can send a malformed SAML response to trigger this vulnerability. (CVE-2025-46705)

    A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of     Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting     in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
    (CVE-2025-46784)

    A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of     Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code     execution. An attacker can send a malformed SAML response to trigger this vulnerability. (CVE-2025-47151)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0862 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-47151:
    A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of     Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code     execution. An attacker can send a malformed SAML response to trigger this vulnerability.

    CVE-2025-46705:
    A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert     Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An     attacker can send a malformed SAML response to trigger this vulnerability.

    CVE-2025-46404:
    A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of     Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An     attacker can send a malformed SAML response to trigger this vulnerability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4090-1 advisory.

    - CVE-2025-46784: Fixed memory exhaustion in Entr'ouvert Lasso (bsc#1253094)
    - CVE-2025-46404: Fixed denial of service in Entr'ouvert Lasso (bsc#1253092)
    - CVE-2025-46705: Fixed denial of service in Entr'ouvert Lasso (bsc#1253093)
    - CVE-2025-47151: Fixed type confusion vulnerability in the       lasso_node_impl_init_from_xml functionality (bsc#1253095)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4094-1 advisory.

    - CVE-2025-46784: Fixed memory exhaustion in Entr'ouvert Lasso (bsc#1253094)
    - CVE-2025-46404: Fixed denial of service in Entr'ouvert Lasso (bsc#1253092)
    - CVE-2025-46705: Fixed denial of service in Entr'ouvert Lasso (bsc#1253093)
    - CVE-2025-47151: Fixed type confusion vulnerability in the       lasso_node_impl_init_from_xml functionality (bsc#1253095)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21406 advisory.

    The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On     standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of     SAML-based federations and provides bindings for multiple languages.

    Security Fix(es):

    * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21400 advisory.

    The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On     standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of     SAML-based federations and provides bindings for multiple languages.

    Security Fix(es):

    * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0183 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-47151:
    A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of     Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code     execution. An attacker can send a malformed SAML response to trigger this vulnerability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:21462 advisory.

    * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11103:01 advisory.

    * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4068-1 advisory.

    - CVE-2025-46404: Fixed denial of service in Entr'ouvert Lasso (bsc#1253092)
    - CVE-2025-46705: Fixed denial of service in Entr'ouvert Lasso (bsc#1253093)
    - CVE-2025-47151: Fixed type confusion vulnerability in the       lasso_node_impl_init_from_xml functionality (bsc#1253095)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the lasso package has been released.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:21402 advisory.

    The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On     standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of     SAML-based federations and provides bindings for multiple languages.

    Security Fix(es):

    * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-21404 advisory.

    [2.5.1-8.0.1]
    - Fixes CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso [Orabug: 38658691]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
275788	AlmaLinux 8 : lasso (ALSA-2025:21628)	Nessus	Alma Linux Local Security Checks	2025/11/19	2025/11/19	critical
275809	AlmaLinux 9 : lasso (ALSA-2025:21462)	Nessus	Alma Linux Local Security Checks	2025/11/19	2025/11/19	critical
275828	Oracle Linux 8 : lasso (ELSA-2025-21628)	Nessus	Oracle Linux Local Security Checks	2025/11/20	2025/11/20	critical
274680	Amazon Linux 2 : lasso, --advisory ALAS2-2025-3077 (ALAS-2025-3077)	Nessus	Amazon Linux Local Security Checks	2025/11/11	2025/11/11	critical
275397	TencentOS Server 4: lasso (TSSA-2025:0862)	Nessus	Tencent Local Security Checks	2025/11/14	2025/12/4	critical
275409	SUSE SLES15 Security Update : lasso (SUSE-SU-2025:4090-1)	Nessus	SuSE Local Security Checks	2025/11/14	2025/11/14	critical
275506	SUSE SLES12 Security Update : lasso (SUSE-SU-2025:4094-1)	Nessus	SuSE Local Security Checks	2025/11/16	2025/11/16	critical
275521	RHEL 9 : lasso (RHSA-2025:21406)	Nessus	Red Hat Local Security Checks	2025/11/17	2025/11/17	critical
275535	RHEL 8 : lasso (RHSA-2025:21400)	Nessus	Red Hat Local Security Checks	2025/11/17	2025/11/17	critical
276531	Alibaba Cloud Linux 3 : 0183: lasso (ALINUX3-SA-2025:0183)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/11/22	2025/11/22	critical
276537	RockyLinux 9 : lasso (RLSA-2025:21462)	Nessus	Rocky Linux Local Security Checks	2025/11/22	2025/11/22	critical
282789	MiracleLinux 8 : lasso-2.6.0-14.el8_10 (AXSA:2025-11103:01)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/2/16	critical
275280	SUSE SLES15 / openSUSE 15 Security Update : lasso (SUSE-SU-2025:4068-1)	Nessus	SuSE Local Security Checks	2025/11/13	2025/11/13	critical
275313	Photon OS 5.0: Lasso PHSA-2025-5.0-0674	Nessus	PhotonOS Local Security Checks	2025/11/13	2025/11/13	critical
275524	RHEL 8 : lasso (RHSA-2025:21402)	Nessus	Red Hat Local Security Checks	2025/11/17	2025/11/17	critical
278178	Oracle Linux 7 : lasso (ELSA-2025-21404)	Nessus	Oracle Linux Local Security Checks	2025/12/11	2025/12/11	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical