-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 06 Sep 2025 11:46:12 +0200 Source: shibboleth-sp Architecture: source Version: 3.5.0+dfsg-2+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Shib Team Changed-By: Ferenc Wágner Closes: 1114506 Changes: shibboleth-sp (3.5.0+dfsg-2+deb13u1) trixie-security; urgency=high . * [627cc27] New patch: SSPCPP-1014 - Extend escaping in strings. Fix SQL injection vulnerability in Service Provider ODBC plugin: specially crafted inputs can exfiltrate information stored in the database used by the SP. The vulnerability is moderate to high severity for anyone using the ODBC plugin, and of no impact for others. Thanks to Scott Cantor (Closes: #1114506) Checksums-Sha1: 801b5e56ba9c6fa842e9f1bf81b2754bc0425ddc 2862 shibboleth-sp_3.5.0+dfsg-2+deb13u1.dsc 20daf89c8c6400e43e2fee1fcfa80bdc2c51b608 653360 shibboleth-sp_3.5.0+dfsg.orig.tar.xz 5e985b44fb8c31821320c1be57e9cc4f6d867e84 41452 shibboleth-sp_3.5.0+dfsg-2+deb13u1.debian.tar.xz 48291bf927a3765aa6eb40e6aa5d4da8bb731607 14993 shibboleth-sp_3.5.0+dfsg-2+deb13u1_amd64.buildinfo Checksums-Sha256: c9cc627fe3d77d40328aa73f1fbd34a47f23ff63ced5c82488fbbc7728dc8ed6 2862 shibboleth-sp_3.5.0+dfsg-2+deb13u1.dsc d01e728167343c7f19ceb754fcd26f00d7d6260f28c2e47752055f4eb2d668ee 653360 shibboleth-sp_3.5.0+dfsg.orig.tar.xz 38a28689c7e3a0f35b0c2c9469531b69de02e88cf2f9b1480e68b1277372e71e 41452 shibboleth-sp_3.5.0+dfsg-2+deb13u1.debian.tar.xz 4a8ac6c5a734869031e8057db175f892d6f86ba57f713700fbf703db29465f82 14993 shibboleth-sp_3.5.0+dfsg-2+deb13u1_amd64.buildinfo Files: 8d70bdcef886e34b5a68012a727e819d 2862 web optional shibboleth-sp_3.5.0+dfsg-2+deb13u1.dsc 680480c6b9a94b6c0ebc69d55113e83b 653360 web optional shibboleth-sp_3.5.0+dfsg.orig.tar.xz 6adc4dcb49c76bfc38cf5bf16bef4e81 41452 web optional shibboleth-sp_3.5.0+dfsg-2+deb13u1.debian.tar.xz 3f9751b04d9e401c29146134fd57b877 14993 web optional shibboleth-sp_3.5.0+dfsg-2+deb13u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwddEx0RNIUL7eugtOsj3Fkd+2yMFAmi8CmwACgkQOsj3Fkd+ 2yMKoQ/+KhvRLkAkIWnIaS9paPFagJz1qnjXg7vrXsng5Mbb7vYVNXjfNNeI+dWF heIBB3XwHKcy87UHsywIsBBENvlSnS9b8tO3sqMnhhpIQzGNR9tfBOMa/7o2VLWZ vkibYHSaNmwwyr/3oM1KRH3Kop4eMaw8vseT0AgDCom4I01D3qbuqdaWyGiDSJwK o8D9xVBvPH6ETB2x43viozT3MD/OzQAlJQPSHJy3f7lEinEdgBzUL0bx4d49j03A m8wOLZn+Tae+NqR64OGiZ2iIbnYT6OBgHpn8tDlsxRbu2rS7o5dN3HFC9xP31aGE 139ZOALR36WWyyiX8hsArjk9JvtkRZAgd39/uDZJeQ+yAxXI3M3lkZ7KsddlozOS km95NQEaivGy73PH12GLvgY9xY/MOvxoKISZbj2wFHZtzVNv6OYdU6t257y2U+hM vFD5kqT/PF7zzgol1WnVicd47t6zDqEVVX/BwXBiscloWBavq0t1vts5zfM5qnf9 0YT6zMvTuZZnT+qhjx/3gzc5vo9NkMvt447C0sGfJSuH5GdxVmdT8v8Iu9zqsc1j KA9Udp6qGYYkFTrX40cT/8W/qwzKPQASr2AirPFwbPYkJNTtrXivUNmNQrxFOZdf 4dBGzUbzfiNHT2oNbkLvrzNDMR4WwYkKJ0D7Lu83SZpSyc1mrFs= =Baj8 -----END PGP SIGNATURE-----