Significant OpenSAML advisories/patches

[jehan.procaccia at tem-tsp.eu]

Where are the pre-release patched packages ? the [1] mentioned earlier 
is empty / forbidden :

/[1] https://shibboleth.net/downloads/prerelease/RPMS//

perhaps it's been push on official repo from now ?
like 
:/https://shibboleth-mirror.cdi.ti.ja.net/CentOS_7/x86_64/libsaml13-3.3.1-3.el7.x86_64.rpm 
#dates 2025-03-13 ...
/
?

On a SP I issued a yum update , /opensaml-schemas /and /libsaml13/ 
packages have been updated to
/
/
/opensaml-schemas-3.3.1-3.el7.x86_64
libsaml13-3.3.1-3.el7.x86_64/

unfortunatly , the lastest ChangeLogs doesn't mention the fix

/# rpm -q --changelog opensaml-schemas
* jeu. févr. *06 2025 John W. O'Brien <john at saltant.com> - 3.3.0-3*
- SSPCPP-1003 Remove support for RHEL 6
- SSPCPP-1004 Remove support for Amazon Linux 1/

Does the packager forgot to updated Changelogs ?

does those/*saml*3.3.1-3/ packages contains a fix ?

Thanks .



On 13/03/2025 18:47, Jason Howe via users wrote:
> On 3/13/25 10:41 AM, Cantor, Scott via users wrote:
>>> Someone pointed out to me that simplesamlphp just release
>>> a new version to address a security vulnerability that has
>>> some of the keywords as the opensaml issue. If that turns
>>> out to be close enough to enable an attacker to exploit the
>>> opensaml issue, might justify speeding up release.
>> If we need to it's ready, I just wanted more testing done to avoid 
>> regressions and I don't have any ready way to do that, I don't run 
>> SPs really at all anymore.
>>
>> That GitHub issue should not have been made public in that form and 
>> it's irresponsible of them to have done so.
>>
>> For the record, the SP issue that matters does not involve 
>> HTTP-Redirect  because no SP should ever accept SSO responses over 
>> that binding, it is a MUST NOT in the standard to do so. Forging 
>> logout messages isn't something we see as critical.
>>
>> If you see a commercial SP allowing that, they quite likely have a 
>> serous, serious issue to fix. That's all I can say on that.
>>
>> -- Scott
>>
> I've installed the pre-release RPMs on a test SP, no issues detected 
> so far with our very vanilla use case with HTTP-POST bindings.
>
> --Jason
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250316/45cdc5cf/attachment.htm>