Skip to content
This repository has been archived by the owner on Jan 28, 2020. It is now read-only.

Version 0.12.0
Compare
Choose a tag to compare
@olavmrk olavmrk released this 09 Mar 09:03
· 136 commits to master since this release
v0.12.0
This tag was signed with the committer’s verified signature.
olavmo-sikt Olav Morken
GPG key ID: 529366E68267B987
Learn about vigilant mode.
bbca80e

Security fixes:

  • [CVE-2016-2145] Fix DOS attack (Apache worker process crash) due to incorrect error handling when reading POST data from client.
  • [CVE-2016-2146] Fix DOS attack (Apache worker process crash / resource exhaustion) due to missing size checks when reading POST data.

In addition this release contains the following new features and fixes:

  • Add MellonRedirectDomains option to limit the sites that mod_auth_mellon can redirect to. This option is enabled by default.
  • Add support for ECP service options in PAOS requests.
  • Fix AssertionConsumerService lookup for PAOS requests.
Assets 3
Loading