- Update to 0.18.1
* Logout endpoint should handle idP POST response
* mellon_create_metadata.sh: Fix compatibility with OpenSSL 3
* Add some clarification to the documentation
* Add encryption certificate to generated metadata
- Changes in 0.18.0
* CVE-2021-3639 Redirect URL validation bypass - Version 0.17.0 and
older of mod_auth_mellon allows the redirect URL validation to be
bypassed by specifying an URL formatted as ///fishing-site.example.com/logout.html.
In this case, the browser would interpret the URL differently
than the APR parsing utility mellon uses and redirect to
fishing-site.example.com. This could be reproduced with:
https://rp.example.co.jp/mellon/logout?ReturnTo=///fishing-site.example.com/logout.html
This version fixes that issue by rejecting all URLs that start with "///".
* A new option MellonSessionIdleTimeout that represents the amount of
time a user can be inactive before the user's session times out in seconds.
* Several build-time fixes
* The CookieTest SameSite attribute was only set to None if mellon configure option
MellonCookieSameSite was set to something other than default. This is now fixed.
- add libtool and xmlsec1-openssl-devel as new dependencies
- set Buildarch to noarch for docs sub-package
OBS-URL: https://build.opensuse.org/request/show/1101582
OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_auth_mellon?expand=0&rev=10
- Update to 0.17.0
* New option MellonSendExpectHeader (default On) which allows to
disable sending the Expect header in the HTTP-Artifact binding to
improve performance when the remote party does not support this
header.
* Set SameSite attribute to None on on the cookietest cookie.
* Bump default generated keysize to 3072 bits in
mellon_create_metadata
* Validate if the assertion ID has not been used earlier before
creating a new session.
* Release session cache after calling invalidate endpoint.
* In MellonCond directives, fix a bug that setting the NC option
would also activate substring match and that REG would activate
REF.
* Fix MellonCond substring match to actually match the substring on
the attribute value
OBS-URL: https://build.opensuse.org/request/show/833493
OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_auth_mellon?expand=0&rev=6
