Shibboleth Service Provider Security Advisory [21 July 2015]

[Peter Schober]

* Ozcan SAHIN <ozcan.sahin at univ-lyon2.fr> [2015-07-22 10:46]:
> We use Shibboleth v.2.3.8 on RHEL6.

Also note that there is no Shibboleth SP version 2.3.8, only 2.3 and
2.3.1 (and then 2.4 and so on), released back in 2010.

So you're also confusing an old, unsupported version of the Shibboleth
IDP software with an (unspecified) version of the Shibboleth SP software.
-peter