<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Where are the pre-release patched packages ? the [1] mentioned
earlier is empty / forbidden : <br>
</p>
<p><font size="2"><i>[1] <a class="moz-txt-link-freetext"
href="https://shibboleth.net/downloads/prerelease/RPMS/"
moz-do-not-send="true">https://shibboleth.net/downloads/prerelease/RPMS/</a></i></font></p>
<div class="moz-cite-prefix">perhaps it's been push on official repo
from now ? <br>
</div>
<div class="moz-cite-prefix">like :<font size="2"><i>
<a class="moz-txt-link-freetext"
href="https://shibboleth-mirror.cdi.ti.ja.net/CentOS_7/x86_64/libsaml13-3.3.1-3.el7.x86_64.rpm"
moz-do-not-send="true">https://shibboleth-mirror.cdi.ti.ja.net/CentOS_7/x86_64/libsaml13-3.3.1-3.el7.x86_64.rpm</a>
#dates 2025-03-13 ...<br>
</i></font></div>
<div class="moz-cite-prefix">? <br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On a SP I issued a yum update , <i>opensaml-schemas
</i>and <i>libsaml13</i> packages have been updated to <br>
</div>
<div class="moz-cite-prefix"><i><font size="2"><br>
</font></i></div>
<i><font size="2">opensaml-schemas-3.3.1-3.el7.x86_64<br>
libsaml13-3.3.1-3.el7.x86_64</font></i><br>
<p>unfortunatly , the lastest ChangeLogs doesn't mention the fix <br>
</p>
<p><font size="2"><i># rpm -q --changelog opensaml-schemas<br>
* jeu. févr. <b>06 2025 John W. O'Brien <a
class="moz-txt-link-rfc2396E"
href="mailto:john@saltant.com" moz-do-not-send="true"><john@saltant.com></a>
- 3.3.0-3</b><br>
- SSPCPP-1003 Remove support for RHEL 6<br>
- SSPCPP-1004 Remove support for Amazon Linux 1</i></font><br>
</p>
<p>Does the packager forgot to updated Changelogs ? </p>
<p>does those<i> *saml*3.3.1-3</i> packages contains a fix ?</p>
<p>Thanks . <br>
</p>
<p><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 13/03/2025 18:47, Jason Howe via
users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:b336ef94-21cf-477d-bb1f-91d7e2d68b13@cs.washington.edu">On
3/13/25 10:41 AM, Cantor, Scott via users wrote: <br>
<blockquote type="cite">
<blockquote type="cite">Someone pointed out to me that
simplesamlphp just release <br>
a new version to address a security vulnerability that has <br>
some of the keywords as the opensaml issue. If that turns <br>
out to be close enough to enable an attacker to exploit the <br>
opensaml issue, might justify speeding up release. <br>
</blockquote>
If we need to it's ready, I just wanted more testing done to
avoid regressions and I don't have any ready way to do that, I
don't run SPs really at all anymore. <br>
<br>
That GitHub issue should not have been made public in that form
and it's irresponsible of them to have done so. <br>
<br>
For the record, the SP issue that matters does not involve
HTTP-Redirect because no SP should ever accept SSO responses
over that binding, it is a MUST NOT in the standard to do so.
Forging logout messages isn't something we see as critical. <br>
<br>
If you see a commercial SP allowing that, they quite likely have
a serous, serious issue to fix. That's all I can say on that. <br>
<br>
-- Scott <br>
<br>
</blockquote>
I've installed the pre-release RPMs on a test SP, no issues
detected so far with our very vanilla use case with HTTP-POST
bindings. <br>
<br>
--Jason <br>
<br>
</blockquote>
</body>
</html>