Shibboleth Identity Provider Security Advisory [4 October 2017]

[Cantor, Scott]

On 11/22/17, 7:07 PM, "users on behalf of Baron Fujimoto" <users-bounces at shibboleth.net on behalf of baron at hawaii.edu> wrote:

> Upgrading is definitely on our roadmap, but given our limited staffing,
> internal policy constraints, and the plethora of other projects vying for
> priority, we'd been planning tackle it down the road further.

Not upgrading is equivalent to not patching, with all that that entails.

> However, if you, as a source we'd consider authoritative, are asserting
> that it is not literally not optional to mitigate this security issue in
> 3.2.1 in the interim via one of suggested means, then we would be required
> to reevaluate our current project prioritization and planning.

I'm saying you're running an unsupported version that could be subject to an unfixable vulnerability at any time that will not be patched. That's entirely separate from this issue and how it can be worked around. Mike explained how to fix this specific issue for 3.2.

> Unless we've missed something, I don't recall seeing anything to the effect that
> continued use of 3.2.1 was unacceptable for some reason. If something to
> this effect is out there, then that changes our calculus.

The Shibboleth Project has never in its entire history supported multiple non-major versions of any of its software and we have always been explicit about the state of every version on the wiki (*). 3.2 was unsupported the minute 3.3 was released (**). These are patches. The difference between  a patch and a minor update is that the latter have feature additions, but they are still patches.

-- Scott

(*) "The current stable release of the Identity Provider is V3.3.2, and there is no supported previous stable release."

(**) Yes, we make allowances, if there major problems with a release. We will always assess the impact of not fixing something in an older release that's only weeks out of support. We've, to my knowledge never done that, or if we have, it wasn't more than once or twice in 15 years.