Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 23 Mar 2015 22:40:14 +0100
From: Yves-Alexis Perez <corsac@...ian.org>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com, team@...urity.debian.org
Subject: Re: CVE requests for shibboleth service provider

On lun., 2015-03-23 at 13:44 -0400, cve-assign@...re.org wrote:
> > Recommendations
> > -----------------
> > Update to V2.5.4 or later of the Shibboleth SP software
> 
> Use CVE-2015-2684 for this Shibboleth Service Provider issue. The
> vendor's secadv_20150319.txt advisory is about this CVE in addition to
> unrelated CVEs in two third-party components (Xerces-C and OpenSSL).
> 
> > https://issues.shibboleth.net/jira/issues/?filter=10771
> 
> We currently don't know whether CVE-2015-2684 is one of the above 24
> issues on the "Shibboleth 2 SP 2.5.4 Fixes" list, or whether the
> CVE-2015-2684 fix is separate from all of those.

Thanks,

as far as I can tell, the security vulnerability is not on that list.
The upstream patch is
http://svn.shibboleth.net/view/cpp-sp?view=revision&revision=3894 and
references SSPCPP-632 which is still not public.

Regards,
-- 
Yves-Alexis

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.