Does Shibboleth use Apache "Struts2"?

[Cantor, Scott]

On 7/29/13 3:06 PM, "David Gersic" <dgersic at niu.edu> wrote:

>I'm told that there is at least one university (unknown which one) that
>thinks (?) that maybe Shibboleth (doesn't specify SP, IdP, version(s),
>etc.) may (?) be using Struts2. So, now our security department are
>asking me if we're affected by this supposed maybe vulnerability in
>something I've never heard of.

Well, obviously the SP doesn't. But no, the IdP doesn't use Struts. Nor,
to my knowledge, is it expected to be used in V3. Certainly haven't seen
any discussion of that.

-- Scott