Significant OpenSAML advisories/patches

[Cantor, Scott]

Since this is publically known, absent the details, the Board and I decided we could take advantage and make a prerelease version of the patched library available for testing by anybody interested in doing so. We will then do the official release and disclosures next week.

The goal of the testing is not to see if the bug is fixed but to make sure we didn't break anything with the fix, so the testing is really just "see if you notice anything, but you shouldn't".

At this stage, I've got the Windows update done and it is uploaded and signed [1].

That's going to *be* the updated release if nothing else happens between now and then, so it's a release candidate essentially. I will bump the last digit as needed if something does change so the future update can be applied on top.

I will be working on getting libsaml RPMs built and made available in the same place for testing, I will obviously not push them to the mirrors as they're not final yet. I'll update the list when they're ready.

I am not making the source code directly available yet, though I will if the Debian packagers want it for testing. It's not been committed yet.

Lastly, the Java side of this has not been worked on yet (we believe it probably is vulnerable in some fashion but have not confirmed). The Shibboleth IdP impact is much, much lower, so the priority was the SP.

-- Scott

[1] https://shibboleth.net/downloads/prerelease/