shibboleth-sp 1.3.1.dfsg1-3+lenny1build0.9.04.2 source package in Ubuntu

Changelog

shibboleth-sp (1.3.1.dfsg1-3+lenny1build0.9.04.2) jaunty-security; urgency=low

  * fix FTBFS by backporting fixes from 1.3.1.dfsg1-4:
    - Adjust autoreconf calling method so that Autoconf 2.63 will install
      supporting files.  (Closes: #533931)
    - Remove additional libtool M4 files on debian/rules clean.

shibboleth-sp (1.3.1.dfsg1-3+lenny1build0.9.04.1) jaunty-security; urgency=low

  * fake sync from Debian

shibboleth-sp (1.3.1.dfsg1-3+lenny1) stable-security; urgency=high

  * SECURITY: Correctly handle decoding of malformed URLs, closing a
    possibly exploitable buffer overflow.
    See <http://shibboleth.internet2.edu/secadv/secadv_20090826.txt>
  * SECURITY: Certificate subject names were incorrectly matched against
    trusted "key names" when they contained nul characters.  This affects
    only Shibboleth deployments relying on the "PKIX" style of trust
    validation, used in the absence of explicit certificate information in
    the SAML metadata provided to the SP and reliance on certificate
    authorities found in the <KeyAuthority> metadata extension element.
    See <http://shibboleth.internet2.edu/secadv/secadv_20090817.txt>

 -- Jamie Strandboge <email address hidden>   Tue, 06 Oct 2009 15:42:18 -0500