diff --git a/.gitignore b/.gitignore index 836a60a..7989c0b 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /mod_auth_mellon-0.9.1.tar.gz /mod_auth_mellon-0.10.0.tar.gz /mod_auth_mellon-0.11.0.tar.gz +/mod_auth_mellon-0.12.0.tar.gz diff --git a/mod_auth_mellon.spec b/mod_auth_mellon.spec index 287a648..04766b5 100644 --- a/mod_auth_mellon.spec +++ b/mod_auth_mellon.spec @@ -1,7 +1,7 @@ Summary: A SAML 2.0 authentication module for the Apache Httpd Server Name: mod_auth_mellon -Version: 0.11.0 -Release: 4%{?dist} +Version: 0.12.0 +Release: 1%{?dist} Group: System Environment/Daemons Source0: https://github.com/UNINETT/mod_auth_mellon/releases/download/v%{version}/%{name}-%{version}.tar.gz Source1: auth_mellon.conf @@ -19,8 +19,6 @@ Requires: httpd-mmn = %{_httpd_mmn} Requires: lasso >= 2.5.0 Url: https://github.com/UNINETT/mod_auth_mellon -Patch1: acs-warning.patch - %description The mod_auth_mellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes @@ -28,7 +26,6 @@ received in assertions generated by a IdP server. %prep %setup -q -n %{name}-%{version} -%patch1 -p1 -b .acs-warning %build export APXS=%{_httpd_apxs} @@ -65,6 +62,24 @@ install -m 755 %{SOURCE4} %{buildroot}/%{_libexecdir}/%{name} %dir /run/%{name}/ %changelog +* Wed Mar 9 2016 John Dennis - 0.12.0-1 +- Update to new upstream 0.12.0 +- [CVE-2016-2145] Fix DOS attack (Apache worker process crash) due to + incorrect error handling when reading POST data from client. + +- [CVE-2016-2146] Fix DOS attack (Apache worker process crash / + resource exhaustion) due to missing size checks when reading + POST data. + +In addition this release contains the following new features and fixes: + +- Add MellonRedirectDomains option to limit the sites that + mod_auth_mellon can redirect to. This option is enabled by default. + +- Add support for ECP service options in PAOS requests. + +- Fix AssertionConsumerService lookup for PAOS requests. + * Thu Feb 04 2016 Fedora Release Engineering - 0.11.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild diff --git a/sources b/sources index c50f057..aaf242e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -d24347881f1c60f26cf686d22cf419de mod_auth_mellon-0.11.0.tar.gz +6c1057847c06d433d4d4a4f55cca1740 mod_auth_mellon-0.12.0.tar.gz