Shibboleth Service Provider Security Advisory [19 April 2012]

[Cantor, Scott]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Shibboleth Service Provider Security Advisory [19 April 2012]

The OpenSSL team disclosed and patched a security issue in
functions that the Shibboleth Service Provider, and some
related libraries, depend on for key and certificate processing.

We do not have specific knowledge of a vulnerability, but since
we believe this issue could in theory create a problem, we are
highlighting this issue in an advisory of our own, and have
updated the OpenSSL version we provide for Microsoft Windows.

The OpenSSL advisory was assigned CVE-2012-2110 can be found at
http://www.openssl.org/news/secadv_20120419.txt

Remediation
===========
Updated Windows installer and postinstall ZIP files for V2.4.3
have been posted that replace the OpenSSL libraries included
with OpenSSL V1.0.0i.

The following files (and their debug siblings) are affected:

\opt\shibboleth\bin\openssl.exe
\opt\shibboleth\lib\libeay32_1_0_0.dll
\opt\shibboleth\lib\ssleay32_1_0_0.dll

Deployers using other platforms should refer to their OpenSSL
technology provider for an update.

URL for this Security Advisory:
http://shibboleth.internet2.edu/secadv/secadv_20120419.txt

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)

iQIcBAEBCgAGBQJPkHFVAAoJEDeLhFQCJ3liq1gP/1jZPOPitFQ06Vy2AAYINhVs
YpwtWRJWD8qYKyeMuMjRROzh0KJepxzfW9kTYUCUgkfhsY97xrvhRkFr30Z8WcNw
pOr+GQHFqsm4lPXvGXvnpIEi43CCBl1p33ikHxaCspgxlvEnxfeYmXz8nNIvsk6s
uEmzHOoxhfbWQXrUGTVGnhNVlsxhaVbPQmFoIwixx8Nxi2OhA93XeBHmVvA8rBwL
7rFkPdmnDmHF54M0Tt02Ox3Mp/ZYKAtQpXGnFKUIzwm/Bu7/gHdnabHQZxVj4aHc
T7Gya5DmvV4GAvG6cbIecDMSBVgI1lJJzXK4EIxYkhQ4C12TnkoJRLp63Tm+APku
teZUQX49AfhEYiZSEEgbY+Y9odsG8Yqs+kC9RXP6Avmv4Lru0RfqASeBJJY/zLSw
P/n8YnMnit5YY5M0G+hOazBx7DDwYqJlztexkHEdrvuU/OHWOp0Tm/GRkeY7bAPR
e9NN9I12G52U1bXLOtpUiBjAysBJQO4avnlA0TH5e73NNaX6kd04WQLGc17ecSZ6
9Cj73/yDLjgBkGtRB3aDfYRAknkoQ23xQE1X8oj/+kQtdAi+UZ+iLlGJYEHU0sTu
7hkLKo9GIzOw4K45a2PUpe7FnAGu/58AU4I+AMC61Hz143UNuSOuN6uvzO2bsTpd
dfQuFSC6E/2RR+SRMD8y
=vhUC
-----END PGP SIGNATURE-----