CVE-2021-33054

Name of the Vulnerable Software and Affected Versions SOGo versions 2.0.5a through 2.4.1 SOGo versions 3.x through 5.x before 5.1.1

Description The issue is related to the incorrect validation of cryptographic signatures in SAML assertions, which could allow a remote attacker to impersonate users when SAML is used as the authentication method. This could potentially impact the integrity of the data.

Recommendations For SOGo versions 2.0.5a through 2.4.1, update to version 2.4.1 or later to resolve the issue. For SOGo versions 3.x through 5.x before 5.1.1, update to version 5.1.1 or later to resolve the issue. As a temporary workaround, consider disabling SAML authentication until a patch is available.