CVE Vulnerabilities

CVE-2021-33054

Improper Verification of Cryptographic Signature

Published: Jun 04, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)

Weakness

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Software

Name Vendor Start Version End Version
Sogo Inverse 2.0.6 (including) 2.4.1 (excluding)
Sogo Inverse 3.0.0 (including) 5.1.1 (excluding)
Sogo Ubuntu bionic *
Sogo Ubuntu groovy *
Sogo Ubuntu hirsute *
Sogo Ubuntu impish *
Sogo Ubuntu kinetic *
Sogo Ubuntu lunar *
Sogo Ubuntu mantic *
Sogo Ubuntu trusty *
Sogo Ubuntu xenial *

References