Date: Mon, 23 Mar 2015 22:40:14 +0100 From: Yves-Alexis Perez <corsac@...ian.org> To: cve-assign@...re.org Cc: oss-security@...ts.openwall.com, team@...urity.debian.org Subject: Re: CVE requests for shibboleth service provider On lun., 2015-03-23 at 13:44 -0400, cve-assign@...re.org wrote: > > Recommendations > > ----------------- > > Update to V2.5.4 or later of the Shibboleth SP software > > Use CVE-2015-2684 for this Shibboleth Service Provider issue. The > vendor's secadv_20150319.txt advisory is about this CVE in addition to > unrelated CVEs in two third-party components (Xerces-C and OpenSSL). > > > https://issues.shibboleth.net/jira/issues/?filter=10771 > > We currently don't know whether CVE-2015-2684 is one of the above 24 > issues on the "Shibboleth 2 SP 2.5.4 Fixes" list, or whether the > CVE-2015-2684 fix is separate from all of those. Thanks, as far as I can tell, the security vulnerability is not on that list. The upstream patch is http://svn.shibboleth.net/view/cpp-sp?view=revision&revision=3894 and references SSPCPP-632 which is still not public. Regards, -- Yves-Alexis Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.