Suggestion for XmlTooling 1.4.1: Shibboleth Service Provider Security Advisory [2018-01-12]

[Rod Widdowson]

> <groupId>org.opensaml</groupId>
> <artifactId>xmltooling</artifactId>
> <version>1.4.1</version>
> <packaging>jar</packaging>

Well that jar is over 2 years old on an unmaintained (for more than 2 years) development branch and is therefore subject to multiple SecAdvs.  Several probably significantly more serious than this one

But one of them won't be the one you quote since it is for C++ and you are speaking Java.

> Please help...

Update to the latest OpenSAML.  But bear in mind that XMLTooling (C++) and OpenSAML (C++, Java) is maintained uniquely in support of Shibboleth.

R