Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2025-47151: A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert La

61
This week
CRITICAL 9.8REMOTEDOWNGRADE

CVE-2025-47151 is a critical-severity flaw (CVSS 9.8) affecting lasso. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.

Why this priority

  • Critical severity
  • Public exploit reference
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score9.8 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance1.1% (top 35%)
CISA exploited listNo
WeaknessCWE-843
Published2025-11-05
Last modified2026-10-18
Publisher (CNA): Talos · Vendor: entrouvert

Share: LinkedIn · X · Reddit

Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

entrouvert lasso DOWNGRADE
Affected: 2.5.1 · 2.8.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.5.1
1. Check installed version
apt-cache policy lasso || rpm -q lasso || lasso --version
2. No fixed release: DOWNGRADE to a release before 2.5.1 (Debian / Ubuntu)
apt-cache madison lasso sudo apt install lasso=<VERSION_BEFORE_2.5.1> sudo apt-mark hold lasso
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list lasso sudo dnf downgrade lasso-<VERSION_BEFORE_2.5.1> sudo dnf versionlock add lasso
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.
Fedora ELN · jgmenu · FIXED · 4.7.0-1.eln159 · FEDORA-2026-40fa69cb49 · source
sudo dnf upgrade --advisory=FEDORA-2026-40fa69cb49
Fedora 46 · trustedqsl · FIXED · 2.8.7-1.fc46 · FEDORA-2026-6b1bc90ebc · source
sudo dnf upgrade --advisory=FEDORA-2026-6b1bc90ebc
Ubuntu 25.10 · lasso · NOT AFFECTED
Ubuntu 22.04 · lasso · FIXED · 2.7.0-2ubuntu0.1
sudo apt update && sudo apt install --only-upgrade lasso dpkg --compare-versions "$(dpkg-query -W -f='${Version}' lasso)" ge "2.7.0-2ubuntu0.1" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.04 · lasso · FIXED · 2.8.2-2ubuntu0.1
sudo apt update && sudo apt install --only-upgrade lasso dpkg --compare-versions "$(dpkg-query -W -f='${Version}' lasso)" ge "2.8.2-2ubuntu0.1" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 25.04 · lasso · FIXED · 2.8.2-8ubuntu0.1
sudo apt update && sudo apt install --only-upgrade lasso dpkg --compare-versions "$(dpkg-query -W -f='${Version}' lasso)" ge "2.8.2-8ubuntu0.1" && echo PATCHED || echo STILL-VULNERABLE
Debian 12 · lasso · FIXED · 2.8.1-1+deb12u1
sudo apt update && sudo apt install --only-upgrade lasso dpkg --compare-versions "$(dpkg-query -W -f='${Version}' lasso)" ge "2.8.1-1+deb12u1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · lasso · FIXED · 2.8.2-9+deb13u1
sudo apt update && sudo apt install --only-upgrade lasso dpkg --compare-versions "$(dpkg-query -W -f='${Version}' lasso)" ge "2.8.2-9+deb13u1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 7 Extended Lifecycle Support · lasso · FIXED · lasso-2.5.1-8.el7_9.1
sudo dnf upgrade --advisory=RHSA-2025:21404 rpm -q lasso
RHEL 8 · lasso · FIXED · lasso-2.6.0-14.el8_10
sudo dnf upgrade --advisory=RHSA-2025:21628 rpm -q lasso
RHEL 8.2 Advanced Update Support · lasso · FIXED · lasso-2.6.0-8.el8_2.1
sudo dnf upgrade --advisory=RHSA-2025:21399 rpm -q lasso
RHEL 8.4 Advanced Mission Critical Update Support · lasso · FIXED · lasso-2.6.0-8.el8_4.1
sudo dnf upgrade --advisory=RHSA-2025:21402 rpm -q lasso
RHEL 8.4 Extended Update Support Long-Life Add-On · lasso · FIXED · lasso-2.6.0-8.el8_4.1
sudo dnf upgrade --advisory=RHSA-2025:21402 rpm -q lasso
Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2025-1285 · source
sudo dnf update --advisory=ALAS2023-2025-1285
Amazon Linux 2 · see advisory · FIXED · ALAS2-2025-3077 · source
sudo yum update --advisory=ALAS2-2025-3077
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-47151?

lasso: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2025-47151 being exploited?

CVE-2025-47151 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-47151 affect?

CVE-2025-47151 affects lasso. Severity is critical (CVSS 9.8). A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed S

How urgent is CVE-2025-47151?

Priority 61/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.