IdP patch and Spring CVE

[Dave Perry]

Sorry, just looking for clarification here.

I note the latest release as of this morning is 5.1.6 (/latest5 says it was published this morning).
If we do NOT use CAS, we should upgrade to 5.1.5 is my read of this? Our internal patching policy doesn't insist on the latest version, but does insist that it's a supported (so this would match up and keep our cyber guy happy).

Thanks
Dave

_________________________________________________

Dave Perry
Application Analyst  |  Innovation & Technology Services

York St John University

Lord Mayor’s Walk, York, YO31 7EX
T: +44(0)1904 876 0000
d.perry1 at yorksj.ac.uk<mailto:d.perry1 at yorksj.ac.uk>  |  www.yorksj.ac.uk<http://www.yorksj.ac.uk/>

[cid:8f2e8570-54e9-4b04-90ef-361660a46e8a]

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott via users <users at shibboleth.net>
Sent: Tuesday, August 19, 2025 6:50 PM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: IdP patch and Spring CVE

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.


As it happens, on top of the Spring issue, a security report came in.

That fix is being included in the 5.1.6 release, but will delay it a bit, hopefully not into next week but that's possible.

I provided a little more detail about that to the member alert list but I won't say more here other than it's a significant issue and it only impacts use of CAS.

-- Scott


--
For Consortium Member technical support, see https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Cd.perry1%40yorksj.ac.uk%7C66aeaa2bd17544970d5c08dddf48fa31%7C5c8ae38ef85b4309b7ec862815a37aee%7C0%7C0%7C638912226709547723%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=U%2BIC95YbvYmCE9BDhDh5jvH9elrmBl9qesfjqkWYvNI%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
[York St John University is the University of the Year for Social Inclusion in The Times and Sunday Times Good University Guide 2025]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250826/d89a0566/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 12155 bytes
Desc: image.png
URL: <http://shibboleth.net/pipermail/users/attachments/20250826/d89a0566/attachment.png>