A new patch release of the IdP software is now available [1] to address a couple of security issues, one internal (advisory forthcoming momentarily), and one in Spring Framework. The Release Notes mention both issues. [2] -- Scott [1] https://shibboleth.net/downloads/identity-provider/ [2] https://shibboleth.atlassian.net/wiki/x/T4C0vg