PT-2021-4286 · Sogo+1 · Sogo+1

Published 2021-06-04 · Updated 2022-12-30 · CVE-2021-33054

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SOGo versions 2.0.5a through 2.4.1 SOGo versions 3.x through 5.x before 5.1.1

Description The issue is related to the incorrect validation of cryptographic signatures in SAML assertions, which could allow a remote attacker to impersonate users when SAML is used as the authentication method. This could potentially impact the integrity of the data.

Recommendations For SOGo versions 2.0.5a through 2.4.1, update to version 2.4.1 or later to resolve the issue. For SOGo versions 3.x through 5.x before 5.1.1, update to version 5.1.1 or later to resolve the issue. As a temporary workaround, consider disabling SAML authentication until a patch is available.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

ALT-PU-2021-1970

ALT-PU-2022-1952

BDU:2021-04894

CVE-2021-33054

DLA-2707-1

DSA-5029-1

MGASA-2022-0481

Affected Products

Alt Linux

Sogo

References · 29

• https://osv.dev/vulnerability/MGASA-2022-0481 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33054 · Security Note
• https://debian.org/security/2021/dsa-5029 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5029-1 · Vendor Advisory
• https://debian.org/lts/security/2021/dla-2707 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-33054 · Security Note
• https://osv.dev/vulnerability/DLA-2707-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33054 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0481.html · Security Note
• https://osv.dev/vulnerability/CVE-2021-33054 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04894 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33054 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-33054 · Vendor Advisory
• https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md · Note