[SCM] Debian packaging for OpenSAML 2.0 branch, master, updated. debian/2.4.1-1-10-ga5fabcf
Russ Allbery
rra at debian.org
Mon Jul 25 20:41:45 UTC 2011
The following commit has been merged in the master branch:
commit b2a23a058be7b42add375836482066ab3cd53e51
Author: Russ Allbery <rra at debian.org>
Date: Mon Jul 25 12:56:10 2011 -0700
Add upstream changes for 2.4.3
diff --git a/debian/changelog b/debian/changelog
index b496505..bcdb3c6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,14 @@
-opensaml2 (2.4.1-2) UNRELEASED; urgency=low
+opensaml2 (2.4.3-1) UNRELEASED; urgency=low
+ * New upstream release.
+ - SECURITY: Fix vulnerability to a "wrapping attack" that could allow
+ a remote, unauthenticated attacker to craft messages that can be
+ successfully verified but contain arbitrary content. This may allow
+ an attacker to subvert the security of software using OpenSAML and
+ supply an unauthenticated login identity and data under the guise of
+ a trusted issuer. (CVE-2011-1411)
+ - Fix unmarshalling of RespondWith element
+ - Make library init routines idempotent
* Update debian/watch for the new upstream distribution location.
-- Russ Allbery <rra at debian.org> Mon, 25 Jul 2011 12:51:55 -0700
--
Debian packaging for OpenSAML 2.0
More information about the Pkg-shibboleth-devel
mailing list