Shibboleth Service Provider Security Advisory [17 March 2021]

[Shannon Roddy]

On 3/17/21 3:12 PM, Peter Schober wrote:
> * Ullfig, Roberto Alfredo <rullfig at uic.edu> [2021-03-17 20:02]:
>> Thanks, are federations sending out notices to registered SPs (they
>> have all the contact info)? I recall InCommon doing that once long
>> ago for an issue.
> 
> For this issue? Not me/us.
> (I don't speak for InC, of course.)
> 
> -peter
> 

We (InCommon) have on occasion sent out advisories.  However, it has
been limited to things that are either unusual or quite serious in order
to escalate and raise awareness.  For "normal" advisories, operators of
the software should monitor the usual channels.

https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories
https://wiki.shibboleth.net/confluence/display/IDP4/SecurityAdvisories

and as pointed out, the announce list.

Best,
Shannon Roddy