<div dir="ltr">Thank you for the update Scott.  <div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div><br></div><div>Brad Mathis</div><div>Principal Systems Analyst</div><div>Pima Community College</div><div>IT - Technical Services</div><div>520.206.4826</div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Apr 23, 2019 at 5:32 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">If you're running Jetty this shouldn't be news since they sent it to the announce list, but they released patches for a directory indexing bug yesterday [1].<br>
<br>
We'll be shipping a patched version in the next Windows patch that goes out for the embedded version, but we already had indexing disabled in the static content handler that's part of that package.<br>
<br>
We do *not* automatically disable it for the IdP itself anywhere because it's a container-specific thing to do but I've updated the Jetty 9.3 and the newly posted 9.4 pages [2][3] with sections on one simple way to do it with just a web.xml modification. There are a variety of ways to do it in Jetty outlined in their page that would be outside the IdP for those who prefer that.<br>
<br>
This sort of thing is strictly the responsibility of deployers, but I wanted to bring it to people's attention.<br>
<br>
-- Scott<br>
<br>
[1] <a href="https://webtide.com/indexing-listing-vulnerability-in-jetty/" rel="noreferrer" target="_blank">https://webtide.com/indexing-listing-vulnerability-in-jetty/</a><br>
[2] <a href="https://wiki.shibboleth.net/confluence/display/IDP30/Jetty93" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/Jetty93</a><br>
[3] <a href="https://wiki.shibboleth.net/confluence/display/IDP30/Jetty94" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/Jetty94</a><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:announce-unsubscribe@shibboleth.net" target="_blank">announce-unsubscribe@shibboleth.net</a><br>
</blockquote></div>