OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

security-services message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: [OASIS Issue Tracker] Updated: (SECURITY-12) PE: Add material onRelayState sanitization

     [ http://tools.oasis-open.org/issues/browse/SECURITY-12?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated SECURITY-12:

Proposal accepted by TC during call on July 26, 2011:

> PE: Add material on RelayState sanitization
> -------------------------------------------
>                 Key: SECURITY-12
>                 URL: http://tools.oasis-open.org/issues/browse/SECURITY-12
>             Project: OASIS Security Services (SAML) TC
>          Issue Type: Improvement
>          Components: Bindings, Profiles
>    Affects Versions: Version 2.0
>            Reporter: Scott Cantor
>             Fix For: 2.0 incorporating Approved Errata
> A recent paper (http://www.ai-lab.it/armando/pub/sec2011.pdf) outlines some threats that in small part involve problems with RelayState handling in implementations. Conversations with the author at the end of last year suggested we add clarifying material if possible to guide implementers to avoid some of the worst problems.

This message is automatically generated by JIRA.
If you think it was sent incorrectly contact one of the administrators: http://tools.oasis-open.org/issues/secure/Administrators.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]