Shibboleth 3, IIS 8.5 Server 2012 Crashing Application Pool

Cantor, Scott cantor.2 at
Fri Dec 6 15:21:30 EST 2019

On 12/6/19, 3:12 PM, "users on behalf of RaymondFord" <users-bounces at on behalf of rtford at> wrote:

> The issue was with the newest version of Shibboleth, 3.0.4.
> I uninstalled 3.0.4 and installed 3.0.3 and everything started working properly.

Whatever the uninstall/reinstall did probably fixed an issue that has nothing to do with that update, and you're now on a version with a trivial denial of service bug in it.

The only issue known to cause crashes in 3.0.4 is just as broken in 3.0.3, the cookie session recovery feature. There are hardly any changes at all in that patch, and nothing on the IIS side.

Most crashes on the app pool side that aren't DLL conflicts are usually permission-related.
-- Scott

More information about the users mailing list