Shibboleth Service Provider Security Advisory [21 July 2015]

[Ozcan SAHIN]

Hello,

Thank you for providing the information.
I am new to Shibboleth, i didn't know that it is quite old version.
Effectively, the solution needs to reinstall Shibboleth environment from 
yum repository to be able to up-to-date it easily.

Best Regards,

Özcan SAHIN

On 22/07/2015 11:41, Peter Schober wrote:
> * Ozcan SAHIN <ozcan.sahin at univ-lyon2.fr> [2015-07-22 10:46]:
>> We use Shibboleth v.2.3.8 on RHEL6.
> See the documentation for supported releases.
>
>> We need to identify how can we correct the vulnerability.
>>
>> Apparently, we need to upgrade to the V2.5.5  of OpenSAML-C library and to
>> V1.5.5 of the XMLTooling-C library.
> The advisory also names a workaround, fyi.
>
>> However, our Shibboleth was installed compiling from source so,
>> up-to-date the system is not a solution for us.
> This is a non sequitur: Why should the fact that you compile packages
> yourself (for whatever reason, specifically on RHEL) instead of using
> pre-compiled packages prevent you from keeping up-to-date and running
> current software?
> The only thing that changed is that you've decided to own the problem
> of keeping up-tp-date. Or rather that you've decided to not care about
> security at all, in the last 5 (!) years, cf.
> https://wiki.shibboleth.net/confluence/display/SHIB2/SecurityAdvisories
>
> There are supported, up-to-date, easy-to-upgrade packages for RHEL6
> available from the Shibboleth project. So compiling from source is
> unneeded. (Most if not all cases should be able to be handled with
> recompiling one or more of the SRPMs.)
>
>> I couln't find the packages (OpenSAML-C and XMLTooling-C ) on system.
>> I have just found the java libraries of shibboleth like below :
>> ../shibboleth/lib/opensaml-2.5.3.jar
>> ../shibboleth/lib/xmltooling-1.3.4.jar
> No idea where you are looking. The documenation has links to all the
> software components, and has full instructions on building the
> software (incl all libraries) on a multitude of platforms, including
> GNU/Linux.
>
> The only sensible way to decide you don't want to use current,
> up-to-date software, is if you can determine the risk of using
> outdated, vulnerable software yourself. From the above you're clearly
> not in a position to do so. Of all the alternatives, updating the
> supported packages made for the reference platform of the Shib SP
> packages is easiest, quickest and safest.
> -peter