Regression identified in Service Provider library, new version pushed

[Kristof Bajnok]

On 2017-11-17 01:20, Cantor, Scott wrote:
> A fix unrelated to the security issue we just released a patch for was erroneous and unfortunately caused a regression in the "traditional" metadata refresh code most people are relying on. An updated xmltooling library, V1.6.2, has been released to undo the change that caused the regression, and updated SP 2.6.1 packages are available for Windows and Linux with the fixed library.

Sorry for asking for the obvious, but the security fix affected the C++
SP and OpenSAML, while the bug affected xmltooling, right? Then how does
the upgrade of SP pull in the xmltooling change? (I've just checked that
the 2.6.1 SP RPM needs xmltooling >=2.6.0, so that should not have
required xmltooling upgrade.)

Does this dance affect people on Debian? It seems that xmltooling is
still on 2.6.0 even after the upgrade.

Thanks,
Kristof