SP 3.5.0.1 for Windows / OpenSAML-C 3.3.1 released

[Cantor, Scott]

The Shibboleth Project has relased a patch for the OpenSAML C++ library (3.3.1) that addresses a critical vulnerability and several "low seriousness" vulnerabilities, some of which depend greatly on how the library is used.

The updated source is available [1] and the RPMs for supported platforms are being built now and should be available by tonight, and I'll update this list once that's done.

The Shibiboleth SP is impacted by these issues but does not need to be rebuilt or otherwise adjusted to correct the issues once the updated library is in place (just restarting shibd is sufficient).

An updated Windows installer is available (versioned 3.5.0.1) containing the updated library. [2]

I will go ahead and issue the advisory now because unlike certain people I did not include a ton of detail in it and it does include a mitigation that some may wish to apply in the meantime.

Finally, we are *not* prepared at this time to publish the updated Java library or IdP patch for this until next week, as the criticality is low (even moderate would be pushing it). A similar advisory will be available for them at that time.

-- Scott 

[1] https://shibboleth.net/downloads/c++-opensaml/latest/
[2] https://shibboleth.net/downloads/service-provider/3.5.0/win64/
https://shibboleth.net/downloads/service-provider/3.5.0/win32/