IdP 3.3.3/CAS Advisory clarification

[O'Dowd, Josh]

The advisory/announcement about the new IdP 3.3.3 version seems to describe the SimpleTicketService as being the vulnerability that  needs to be mitigated.  The solutions appear to be upgrade to 3.3.3, or change cas config to use encoding service ticket.

Can we then conclude that if we opt for solution 1 that v3.3.3 fixes SimpleTicketService and we can continue to use it safely?

Thanks

Josh O'Dowd
Software Systems Engineer / Identity Access Management
University of Montana

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180516/f5dea472/attachment.html>