Significant OpenSAML advisories/patches

[Cantor, Scott]

This shouldn't have been made public, but I can't really comment any further on this here, as I'm not prepared to do so at this time.

I will disclose that there is a critical patch coming for the SP and leave it at that, and just say that I doubt that any effort to get people to locally change configurations is likely to be any more successful than getting people to patch if you can't get people to patch.

Manipulating metadata does not really change what attackers can get away with.

-- Scott