opensaml-governikus-extension-1.1.0.jar (pkg:maven/de.governikus.opensaml.extension/opensaml-governikus-extension at 1.1.0, cpe:2.3:a:shibboleth:opensaml:1.1.0:*:*:*:*:*:*:*) : CVE-2013-6440

[Cantor, Scott]

> I am confused about opensaml releases and which and where is the latest. 

5.0.0 was released a couple of months ago. The only place we distribute it from (and the only place we have ever provided it in any modern form) is our Nexus repository:

https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/2891317253/MavenRepositories

The URLs have been in flux but are stable again and we have removed all references to them from the POMs to prevent problems that have occurred in the past.

> Not sure how this can happen. 

https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1123844333/Use+of+Maven+Central

Not noted there is that even if we wanted to, the legal indemnification required to publish to it is not something any individuals on this project are willing to agree to.

So there are any number of barriers, probably insurmountable, to ever do it. Even if we could, the issue with the other dependencies not being there would preclude it.

-- Scott