<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Does it affect the idp3-2.1 version <font size="2">
<span style="font-size:11pt;">using</span></font> the <font size="2"><span style="font-size:11pt;">using the CAS
<font size="2"><span style="font-size:11pt;">protocol support</span></font>?</span></font></p>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;"><br>
</span></font></p>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;">Thanks,</span></font></p>
<p style="margin-top:0;margin-bottom:0"><font size="2"><span style="font-size:11pt;">Lisa</span></font><br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<p>Lisa L. Bogar</p>
<p>Server Systems Administrator<br>
</p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Palatino Linotype",serif">Montana State University – University Information Technology (UIT)</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Palatino Linotype",serif">2327 University Way,
<span tabindex="0" class="contextualExtensionHighlight ms-font-color-themePrimary ms-border-color-themePrimary ident_1290_1359">
Suite 224 | Montana State University</span></span></p>
<p class="x_MsoNormal" style="line-height:12.65pt; background:white"><span style="font-size:10.0pt; font-family:"Palatino Linotype",serif"><span tabindex="0" class="contextualExtensionHighlight ms-font-color-themePrimary ms-border-color-themePrimary ident_1290_1359">PO
BOX 173245, Bozeman, MT 59715</span></span></p>
<p class="x_MsoNormal" style="line-height:12.65pt; background:white"><span style="font-size:10.0pt; font-family:"Palatino Linotype",serif"><span tabindex="0" class="contextualExtensionHighlight ms-font-color-themePrimary ms-border-color-themePrimary ident_1290_1359">Campus
Address: CFT5, Suite 224<br>
</span></span></p>
<p class="x_MsoNormal" style="line-height:12.65pt; background:white"><span style="font-size:10.0pt; font-family:"Palatino Linotype",serif"><span tabindex="0" class="contextualExtensionHighlight ms-font-color-themePrimary ms-border-color-themePrimary ident_1290_1359">(406)994-7887<br>
</span></span></p>
</div>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Paul B. Henson <henson@cpp.edu><br>
<b>Sent:</b> Friday, May 11, 2018 6:59 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Upcoming Shibboleth IdP security patch</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On Fri, May 11, 2018 at 08:48:37AM +0200, Simon Lundström wrote:<br>
> According to the vulnerability report it only affects Windows?<br>
> <br>
> Does deployers who use something other than Windows need to patch?<br>
<br>
There are two vulnerabilities:<br>
<br>
* One in Spring, only pertinent to Windows<br>
* One in the idp itself, only pertinent to people running CAS<br>
<br>
So, if you neither run the idp under windows, nor use the idp CAS<br>
support, I guess you don't need to worry about this one, at least not<br>
critically.<br>
<br>
> On Thu, 2018-05-10 at 20:34:04 +0000, Cantor, Scott wrote:<br>
> >We will be releasing a security patch update for the IdP, V3.3.3,<br>
> >currently planned for next Wednesday, May 16th. The patch includes a<br>
> >Spring Framework bump to pick up a fix for [1] and a security fix for<br>
> >a CAS protocol support issue that we will disclose at that time.<br>
> ><br>
> >The CAS issue is of critical severity. Only deployers using the CAS<br>
> >protocol support are impacted.<br>
> ><br>
> >The Spring issue is potentially high in severity (and is public<br>
> >knowledge) but we don't have any reason to believe most, or possibly<br>
> >any, deployers are affected. But erring on the side of caution<br>
> >because we allow a fair amount of Spring MVC customization, we want<br>
> >to make the fixed version available.<br>
> ><br>
> >-- Scott<br>
<br>
-- <br>
Paul B. Henson | (909) 979-6361 | <a href="http://www.cpp.edu/~henson/" id="LPlnk559911" class="OWAAutoLink" previewremoved="true">
http://www.cpp.edu/~henson/</a>
<div id="LPBorder_GT_15263012468360.4482679333442484" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_15263012468340.5942285681695588" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);" role="presentation" cellspacing="0">
<tbody>
<tr style="border-spacing: 0px;" valign="top">
<td id="TextCell_15263012468340.09584514926404353" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;" colspan="2">
<div id="LPRemovePreviewContainer_15263012468340.9810978766715485"></div>
<div id="LPTitle_15263012468340.5186198539846973" style="top: 0px; color: rgb(0, 120, 215); font-weight: 400; font-size: 21px; font-family: "wf_segoe-ui_light", "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_15263012468340.02530890005890607" style="text-decoration: none;" href="http://www.cpp.edu/~henson/" target="_blank">www.cpp.edu</a></div>
<div id="LPMetadata_15263012468340.917963020893472" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: 400; font-family: "wf_segoe-ui_normal", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
www.cpp.edu</div>
<div id="LPDescription_15263012468360.6848403196297348" style="display: block; color: rgb(102, 102, 102); font-weight: 400; font-family: "wf_segoe-ui_normal", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
ObDisclaimer: I don't do web design. You can look at: Projects A very obsolete resume</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
Operating Systems and Network Analyst | henson@cpp.edu<br>
California State Polytechnic University | Pomona CA 91768<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" id="LPlnk588401" class="OWAAutoLink" previewremoved="true">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</div>
</body>
</html>