[SCM] Debian packaging for OpenSAML 2.0 branch, master, updated. debian/2.4.1-1-10-ga5fabcf

Russ Allbery rra at debian.org
Mon Jul 25 20:41:45 UTC 2011


The following commit has been merged in the master branch:
commit b2a23a058be7b42add375836482066ab3cd53e51
Author: Russ Allbery <rra at debian.org>
Date:   Mon Jul 25 12:56:10 2011 -0700

    Add upstream changes for 2.4.3

diff --git a/debian/changelog b/debian/changelog
index b496505..bcdb3c6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,14 @@
-opensaml2 (2.4.1-2) UNRELEASED; urgency=low
+opensaml2 (2.4.3-1) UNRELEASED; urgency=low
 
+  * New upstream release.
+    - SECURITY: Fix vulnerability to a "wrapping attack" that could allow
+      a remote, unauthenticated attacker to craft messages that can be
+      successfully verified but contain arbitrary content.  This may allow
+      an attacker to subvert the security of software using OpenSAML and
+      supply an unauthenticated login identity and data under the guise of
+      a trusted issuer.  (CVE-2011-1411)
+    - Fix unmarshalling of RespondWith element
+    - Make library init routines idempotent
   * Update debian/watch for the new upstream distribution location.
 
  -- Russ Allbery <rra at debian.org>  Mon, 25 Jul 2011 12:51:55 -0700

-- 
Debian packaging for OpenSAML 2.0



More information about the Pkg-shibboleth-devel mailing list