Shib IdP - Metadata Download and Java 1.7.0_85

[Brent Putman]

On 7/23/15 10:49 AM, Cantor, Scott wrote:
> On 7/23/15, 2:20 AM, "users on behalf of Brent Putman" <users-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:
>> I really did not believe that they could do something so egregious.  So I had to test it (on "old" vs. "new" Java 8, since I don't have and can't currently get the last Java 7 with this change).  And in fact that is exactly what they have done.
> So this isn't in the original Java 8 but is now? What's the version cut off? Would be useful to document that.

Yes.  My understanding from the RedHat issue Takeshi originally posted
[1] in JOWS-39 is that they "fixed" it in the July 2015 updates for all
3 versions: 6u101, 7u85, and 8u51

[1] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-2625


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150723/40c8dd38/attachment-0001.html>