Security bug in xml-security-c may require rebuilding of this package

[John Cooper]

There is a security vulnerability in the xml-security-c library that may require this module to be rebuilt once that has been patched.

More info at:

http://shibboleth.internet2.edu/secadv/secadv_20110706.txt

I have logged the xml library bug already and will link to it.

[John Cooper (choffee)]

This links to the Bug #807414 in the xml-security-c package.

[Steve Beattie (sbeattie)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Joshua Daniel Franklin (joshuadfranklin)]

I'd love to see this security update synced from debian.

[Aaron J. Zirbes (ajz)]

RE: sbeattie,

If this is a bug to to an upstream linked library, only a re-compile and re-package once
libxml-security-c15 1.5.1-3+squeeze1build0.10.04.1 is installed is required?

Right? No need for a debdiff?

[Russ Allbery (rra-debian)]

No update or recompile of the shibboleth-sp2 package is required for either the xml-security-c or the opensaml2 security advisories so far as I know. Only upgrading the libraries to patched versions and then restarting shibd and Apache is required, I think. The changes didn't affect the external API of the libraries, only the internal shared library code.

[Russ Allbery (rra-debian)]

Marking invalid since, as noted, no recompilation should be required after the affected library package was upgraded.