xmltooling_1.5.3-2+deb8u2_i386.changes ACCEPTED into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates

[Debian FTP Masters]

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 12 Jan 2018 12:00:08 +0100
Source: xmltooling
Binary: libxmltooling6 libxmltooling-dev xmltooling-schemas libxmltooling-doc
Architecture: source i386
Version: 1.5.3-2+deb8u2
Distribution: jessie-security
Urgency: high
Maintainer: Debian Shib Team <pkg-shibboleth-devel at lists.alioth.debian.org>
Changed-By: Ferenc Wágner <wferi at debian.org>
Description:
 libxmltooling-dev - C++ XML parsing library with encryption support (development)
 libxmltooling-doc - C++ XML parsing library with encryption support (API docs)
 libxmltooling6 - C++ XML parsing library with encryption support (runtime)
 xmltooling-schemas - XML schemas for XMLTooling
Changes:
 xmltooling (1.5.3-2+deb8u2) jessie-security; urgency=high
 .
   * [5c2845b] Add gbp.conf for jessie
   * [0ffc343] Convert our single patch into a proper patch queue
   * [91e7acb] New patch: CVE-2018-0486: vulnerability to forged user attribute
     data
     The Service Provider software relies on a generic XML parser to process
     SAML responses and there are limitations in older versions of the parser
     that make it impossible to fully disable Document Type Definition (DTD)
     processing.
     Through addition/manipulation of a DTD, it's possible to make changes
     to an XML document that do not break a digital signature but are
     mishandled by the SP and its libraries. These manipulations can alter
     the user data passed through to applications behind the SP and result
     in impersonation attacks and exposure of protected information.
     While the use of XML Encryption can serve as a mitigation for this bug,
     it may still be possible to construct attacks in such cases, and the SP
     does not provide a means to enforce its use.
     CPPXT-127 - Block entity reference nodes during unmarshalling.
     https://issues.shibboleth.net/jira/browse/CPPXT-127
     Thanks to Scott Cantor
   * [49b7352] Update Uploaders: add Etienne, remove Russ, update myself
Checksums-Sha1:
 ed080fec57bfe948674b7805153f1472051f5bf6 2433 xmltooling_1.5.3-2+deb8u2.dsc
 5c149d59a2a7294349ee8447f2ed990f7480229f 10820 xmltooling_1.5.3-2+deb8u2.debian.tar.xz
 bfe1a7f8264c05fcb6d8067b175ac71d8864f24a 588608 libxmltooling6_1.5.3-2+deb8u2_i386.deb
 cb611ec73f64fbdb9b9cb45e31bc39427592d4eb 72314 libxmltooling-dev_1.5.3-2+deb8u2_i386.deb
Checksums-Sha256:
 66bca125a52487e64cbb16efab1b7118109a95c769eddb571b72b79384dd4927 2433 xmltooling_1.5.3-2+deb8u2.dsc
 51f0ae9d4e419ccbafcec9a272ed2daa0456643816aeae5231045a96519377f5 10820 xmltooling_1.5.3-2+deb8u2.debian.tar.xz
 9add3d1f915d6d54c37b4c930037e4f00be0524acd66c16faf0902ed16243380 588608 libxmltooling6_1.5.3-2+deb8u2_i386.deb
 5f97ebed46427aa8bdb87a86c437aef00c5198e389cf3ea7b516233f526c74a8 72314 libxmltooling-dev_1.5.3-2+deb8u2_i386.deb
Files:
 23f975913adaff394d5b55b26e9042a8 2433 libs extra xmltooling_1.5.3-2+deb8u2.dsc
 7c9ce057e6b3f5b87d8f762cc1eec611 10820 libs extra xmltooling_1.5.3-2+deb8u2.debian.tar.xz
 1e96dbb7ce98caa09a4c681f6093c610 588608 libs extra libxmltooling6_1.5.3-2+deb8u2_i386.deb
 c918c7fd8aa568fdfb31b0a60f48f6cd 72314 libdevel extra libxmltooling-dev_1.5.3-2+deb8u2_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwddEx0RNIUL7eugtOsj3Fkd+2yMFAlpZFMkACgkQOsj3Fkd+
2yN8Xg/+I05bEBBWPFWd/NxDMG/bFKEluZs0rVIqjh6C4n/iCH+iaRh3wpNremoh
7mt+3BZ/KeJDgXoaG0vJ8HJF3nkIHQhg18/GGpKByvnKJiTuGmCBq50EO1yroj0j
oRsbIyEM5w7h33pFhVbhsXhZDv9veu1SGpCdgdHPZKWpJSMpNahzKF2N2k8NanOZ
Jcz9fiXKHn/DWoSgjHBIN5F8255bP4zEOnEZ+kpRo8UaUcHNrAWJmWwuDQQl7y4W
SkxV6lGQ0CFsuED6bxcgLj73SJyg/DMelGD+/hAzVirwqyukZFI/NlU4felvXrFo
0VG4CW/Uk5K1V78TK7wyZ1EWWM8Lk2CyfynrQiuj9vxY07LFkcVcUyYpukIbClqX
vPYDL36S2lX1J8h+nUCZj0+zBH6AumTFF1SypD6qsGeatuaDHAtNL6CSzQ/YDyVQ
QKWy8TenGnRqmc0m6yTFjdcLI1NrDyeBzpTK6NVSoRqdKvNfk0WaUBnVLN8Wb/O0
Y/McvNxl/oikZQ6GTGDqglJitf7CXy0j+cWbYzh+sWWuHBJdCM0bBuKcyT33/Lmm
OWHs9zxVj1Evb7ADbiu3cuVUrKFrhYGqU7G6B2sIcEFWonDKeWq+PW/aFYJj2UGD
Kfmi5DvMPv1B5g3Nc1oGqhwBI3TEP7byBV9XtxZ7FP7aEQCKBZY=
=SjH1
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.