Shibboleth Service Provider V2.6.0 now available

[Wessel, Keith]

Got it.

So, RHEL 6/CentOS 6 SP RPMs have xerces-c 3.1 built in then, and RHEL 6 folks don't need to worry about this one once they upgrade the SP?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, June 29, 2016 4:34 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Shibboleth Service Provider V2.6.0 now available

> Doesn't include xerces-c? It does when I yum search for it: xerces-c 3.0.1-
> 20.el6.
> 
> Is that version not vulnerable?

I misspoke. 6 included 3.0, but I didn't know that at the time and I had already shipped my build. 3.1 and 3.0 aren't ABI-compatible, so once I published it I kept doing it, and that's still the situation now. The SP won't link to the version RH supplies, so it's moot to me what they do with it.

RH7 and OpenSUSE 13 are the two supported platforms with dependencies on a broken version that I can't fix. If you care about it, you can build one yourself, install to /opt/shibboleth, and the same change that gets libcurl picked up will get it to use that version.

-- Scott
 
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net