Shibboleth Service Provider Security Advisory [21 July 2015]

[Peter Schober]

* Ozcan SAHIN <ozcan.sahin at univ-lyon2.fr> [2015-07-22 10:46]:
> We use Shibboleth v.2.3.8 on RHEL6.

See the documentation for supported releases.

> We need to identify how can we correct the vulnerability.
> 
> Apparently, we need to upgrade to the V2.5.5  of OpenSAML-C library and to
> V1.5.5 of the XMLTooling-C library.

The advisory also names a workaround, fyi.

> However, our Shibboleth was installed compiling from source so,
> up-to-date the system is not a solution for us.

This is a non sequitur: Why should the fact that you compile packages
yourself (for whatever reason, specifically on RHEL) instead of using
pre-compiled packages prevent you from keeping up-to-date and running
current software?
The only thing that changed is that you've decided to own the problem
of keeping up-tp-date. Or rather that you've decided to not care about
security at all, in the last 5 (!) years, cf.
https://wiki.shibboleth.net/confluence/display/SHIB2/SecurityAdvisories

There are supported, up-to-date, easy-to-upgrade packages for RHEL6
available from the Shibboleth project. So compiling from source is
unneeded. (Most if not all cases should be able to be handled with
recompiling one or more of the SRPMs.)

> I couln't find the packages (OpenSAML-C and XMLTooling-C ) on system.
> I have just found the java libraries of shibboleth like below :
> ../shibboleth/lib/opensaml-2.5.3.jar
> ../shibboleth/lib/xmltooling-1.3.4.jar

No idea where you are looking. The documenation has links to all the
software components, and has full instructions on building the
software (incl all libraries) on a multitude of platforms, including
GNU/Linux.

The only sensible way to decide you don't want to use current,
up-to-date software, is if you can determine the risk of using
outdated, vulnerable software yourself. From the above you're clearly
not in a position to do so. Of all the alternatives, updating the
supported packages made for the reference platform of the Shib SP
packages is easiest, quickest and safest.
-peter