CVE-2025-46705
📋 TL;DR
A denial of service vulnerability in Entr'ouvert Lasso's g_assert_not_reached function allows attackers to crash applications by sending specially crafted SAML assertion responses. This affects systems using Lasso 2.5.1 and 2.8.2 for SAML authentication. Organizations using these versions for identity management are vulnerable.
💻 Affected Systems
- Entr'ouvert Lasso
📦 What is this software?
Lasso by Entrouvert
Lasso by Entrouvert
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for applications relying on Lasso for SAML authentication, potentially affecting user access to critical systems.
Likely Case
Application crashes or hangs when processing malicious SAML responses, causing temporary authentication failures.
If Mitigated
Limited impact with proper network filtering and monitoring; potential brief service interruptions.
🎯 Exploit Status
Attack requires sending malformed SAML responses to vulnerable endpoints; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for patched versions
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2196
Restart Required: Yes
Instructions:
1. Check current Lasso version. 2. Apply vendor-recommended patch or upgrade. 3. Restart affected services. 4. Verify fix implementation.
🔧 Temporary Workarounds
Network Filtering
allBlock or filter incoming SAML responses at network perimeter
Input Validation
allImplement additional SAML response validation before passing to Lasso
🧯 If You Can't Patch
- Implement network-level filtering to block suspicious SAML traffic
- Deploy WAF rules to detect and block malformed SAML assertions
🔍 How to Verify
Check if Vulnerable:
Check Lasso version: lasso-config --version or examine package managerCheck Version:
lasso-config --version || dpkg -l | grep lasso || rpm -qa | grep lassoVerify Fix Applied:
Verify version is updated and test with valid SAML responses📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Unexpected g_assert_not_reached errors
- SAML processing failures
Network Indicators:
- Malformed SAML responses
- Repeated authentication failures from single source
SIEM Query:
source="application_logs" AND ("g_assert_not_reached" OR "SAML processing error")