CVE-2021-28091

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://listes.entrouvert.com/arc/lasso/Product
https://git.entrouvert.org/lasso.git/commit/?id=076a37d7f0eb74001127481da2d355683693cde9Patch, Vendor Advisory
https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0Release Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00013.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SI4YAQF4VEV2KHQ6OXXZL7CJK7IZQ3EG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSVWOHBBWLI2RB5C6TXINFEJRT4YSD3D/
https://www.debian.org/security/2021/dsa-4926Third Party Advisory
http://listes.entrouvert.com/arc/lasso/Product
https://git.entrouvert.org/lasso.git/commit/?id=076a37d7f0eb74001127481da2d355683693cde9Patch, Vendor Advisory
https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0Release Notes, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00013.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SI4YAQF4VEV2KHQ6OXXZL7CJK7IZQ3EG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSVWOHBBWLI2RB5C6TXINFEJRT4YSD3D/
https://www.debian.org/security/2021/dsa-4926Third Party Advisory

Timeline

Published: Jun 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-280927.5The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReD CVE-2021-280936.5OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32.CVE-2021-280946.5OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32.CVE-2021-280954.8OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, du CVE-2021-280965.3An issue was discovered in Stormshield SNS before 4.2.3 (when the proxy is used). An attacker can saturate the proxy connection table. This CVE-2021-280987.8An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function.CVE-2021-280994.4In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories w CVE-2021-281005.5Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem ca CVE-2021-281096.1TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).CVE-2021-281107.5/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.CVE-2021-281118.8Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker.CVE-2021-281128.8Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker