Lasso is a library that implements the Liberty Alliance Single Sign On
standards, including the SAML and SAML2 specifications. It allows to handle
the whole life-cycle of SAML based Federations, and provides bindings
for multiple languages.
* Fri Nov 14 2025 Tomas Halman <thalman@redhat.com> - 2.6.0-14
- Fixing CVE-2025-47151
Resolves: RHEL-126687 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso
* Wed Jul 26 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 2.6.0-13
- Rebuilt for MSVSphere 8.8
* Wed May 04 2022 Tomas Halman <thalman@redhat.com> - 2.6.0-13
- Publishing the python3-lasso binding
- Resolves: rhbz#1888195 - Release python lasso package
* Fri Jul 30 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-12
- Fix a dead code issue in the signature wrapping patch
- Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
vulnerability when parsing SAML responses [rhel-8]
* Mon Jun 21 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-11
- Bump release to force the package through OSCI as the previous
build reached CI just in time for an outage
- Related: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (comingfrom lasso)
* Fri Jun 04 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-10
- Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
vulnerability when parsing SAML responses [rhel-8]
* Thu May 06 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-9
- Resolves: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (coming
from lasso)
* Fri Oct 18 2019 Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-8
- Resolves: rhbz#1730018 - lasso includes "Destination" attribute in SAML
AuthnRequest populated with SP
AssertionConsumerServiceURL when ECP workflow
is used which leads to IdP-side errors
* Fri Jun 14 2019 Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-7
- Resolves: rhbz#1634268 - ECP signature check fails with
LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when
assertion signed instead of response
* Thu Jun 13 2019 Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-6
- Resolves: rhbz#1719020 - Expired certificate prevents tests from running
