Shib IdP - Metadata Download and Java 1.7.0_85

[Takeshi NISHIMURA]

Unfortunately, all RedHat packages listed in [1] may cause this issue, including OpenJDK 7 and 8.
I myself reproduced the issue on CentOS 5 package java-1.7.0-openjdk-1.7.0.85-2.6.1.3.el5_11.

One exception is OpenJDK 6. RedHat has no update of OpenJDK 6 yet. I don't know why.

Takeshi

[1] https://access.redhat.com/security/cve/CVE-2015-2625

On 2015/07/24 2:21, Cantor, Scott wrote:
> On 7/23/15, 1:11 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at internet2.edu> wrote:
>
>> This does blow up a lot of services I’m running which are not tethered to specific IP addresses at all, so it’s going to be really fun for me personally.
>
> Well a) we have always said this was a bad idea and we weren't wrong, and b) at least this only affects people who have access to the latest Oracle code or are on Java 8, and that's a small minority.
>
> Unless OpenJDK pushed this same bug and RH picked it up.
>
> -- Scott