<div dir="ltr">

<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Is anyone else having trouble getting the packages from the repos for RHEL/CentOS?   </span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><div><a href="http://download.opensuse.org/repositories/security%3A/shibboleth/CentOS_7/x86_64/xmltooling-schemas-1.6.4-3.1.x86_64.rpm" target="_blank" style="color:rgb(17,85,204)">http://download.opensuse.org/<wbr>repositories/security%3A/<wbr>shibboleth/CentOS_7/x86_64/<wbr>xmltooling-schemas-1.6.4-3.1.<wbr>x86_64.rpm</a>: [Errno 12] Timeout on<span> </span><a href="http://provo-mirror.opensuse.org/repositories/security:/shibboleth/CentOS_7/x86_64/xmltooling-schemas-1.6.4-3.1.x86_64.rpm" target="_blank" style="color:rgb(17,85,204)">http://provo-mirror.opensuse.<wbr>org/repositories/security:/<wbr>shibboleth/CentOS_7/x86_64/<wbr>xmltooling-schemas-1.6.4-3.1.<wbr>x86_64.rpm</a>: (28, 'Operation too slow. Less than 1000 bytes/sec transferred the last 30 seconds')</div><div>Trying other mirror.</div></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">I've been getting these sorts of timeout errors on both EL6 and EL7 systems since the packages were released.  Yum sees that there are updates, but never can get them downloaded.  Even cleared the yum cache.  Just asking if there is a know problem with the repos before I start manually downloading and installing them.  </div>

<br><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div style="color:rgb(0,0,0);font-family:"Helvetica Neue",Verdana,Arial,sans-serif;font-size:14px;padding-bottom:15px">Sincerely,</div><div style="color:rgb(0,0,0);font-family:"Helvetica Neue",Verdana,Arial,sans-serif;font-size:14px;padding-bottom:5px">Andy Fleming</div><div style="font-family:"Helvetica Neue",Verdana,Arial,sans-serif;color:rgb(136,136,136);font-style:italic;font-size:12px">Systems Engineer</div><div style="color:rgb(0,0,0);font-family:"Helvetica Neue",Verdana,Arial,sans-serif;font-size:14px;padding-top:15px"><div style="padding-top:20px;padding-bottom:15px"><a href="http://www.kanren.net/" target="_blank"><img src="http://www.kanren.net/wp-content/uploads/2016/06/KanREN.png" alt="KanREN" width="250" height="auto"></a></div><table style="font-size:12px;line-height:15px;padding-left:40px;color:rgb(136,136,136)"><tbody><tr><td style="vertical-align:top"><img src="http://www.kanren.net/wp-content/uploads/2016/06/phone.png" alt="phone" width="12" height="auto"> 785-856-9820</td><td style="padding-left:20px;vertical-align:top"><div style="padding-bottom:3px">2029 Becker Drive, Suite 282<br>Lawrence, Kansas 66047</div></td></tr><tr><td colspan="2"><span style="display:inline-block;margin:0px 3px"><a href="https://www.linkedin.com/company/92399?trk=tyah&trkInfo=clickedVertical%3Acompany%2CclickedEntityId%3A92399%2Cidx%3A1-1-1%2CtarId%3A1440002635645%2Ctas%3AKanREN" target="_blank"><img src="http://www.kanren.net/wp-content/uploads/2016/06/linkedin.png" alt="linkedin" width="20" height="auto"></a></span> <span style="display:inline-block;margin:0px 3px"><a href="https://twitter.com/TheKanREN" target="_blank"><img src="http://www.kanren.net/wp-content/uploads/2016/06/twitter.png" alt="twitter" width="20" height="auto"></a></span> <span style="display:inline-block;margin:0px 3px"><a href="http://www.kanren.net/feed/" target="_blank"><img src="http://www.kanren.net/wp-content/uploads/2016/06/rss.png" alt="twitter" width="20" height="auto"></a></span> <a href="mailto:support@kanren.net" style="color:rgb(255,255,255);text-decoration:none;display:inline-block;padding:3px 10px;margin-left:10px;background:rgb(187,187,187)" target="_blank">need support?</a></td></tr></tbody></table></div></div></div></div></div></div>
<br><div class="gmail_quote">On Tue, Feb 27, 2018 at 9:00 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I'm taking the unusual step of adding a follow up announcement on this for a couple of reasons. Firstly, it's not solely a Shibboleth bug and there's a blog article from the Duo researcher now that people should know about. [1]<br>
<br>
Secondly, the implications here may not be clear, so I want to reinforce this: people have not found all the implementations that are vulnerable to this bug and its siblings. CERT reached out to many, but they can't hit everybody, and they naturally omitted a whole lot of the one-off stacks out there used by cloud vendors which many in this community use Shibboleth routinely to integrate.<br>
<br>
As part of my nature study for this process, I investigated, discreetly, a number of SPs that my university has campus-wide integrations with and that did not support XML Encryption. This is the sweet spot for the bug, because truncation attacks generally require overlapping user identifiers, and 150,000 identities provides that kind of thing.<br>
<br>
Out of about 6 I checked, 4 were vulnerable and none of them likely know about this yet. I've started my own campus process of reporting the issues and turning the long crank of getting the vendors aware of them. Unfortunately, this is a process that many of us are going to have to spend time on.<br>
<br>
Some of them were vulnerable to the previous bug we fixed last month, and I also am not even sure that Duo understands the full range of potential flaws here because I found successful attacks that were similar to, but not the same as, the one they formally reported. This is going to be a process.<br>
<br>
Again, focus on the unencrypted integrations. I would also urge all of us to begin to insist on the use of XML Encryption going forward. We will also need to begin the long process of forcing implementations to get compliant with AES-GCM encryption, which will be the default in Shibboleth V4, and which replaces the long-broken AES-CBC encryption used almost universally in SAML today. It's time to fix that.<br>
<br>
-- Scott<br>
<br>
[1] <a href="https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations" rel="noreferrer" target="_blank">https://duo.com/blog/duo-<wbr>finds-saml-vulnerabilities-<wbr>affecting-multiple-<wbr>implementations</a><br>
<div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:announce-unsubscribe@shibboleth.net">announce-unsubscribe@<wbr>shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>