Switch to Latchset distribution now that Uninett version is abandonware.
Changes since 0.14.2 from the NEWS file:
Version 0.17.0
---------------------------------------------------------------------------
Enhancements:
* New option MellonSendExpectHeader (default On) which allows to disable
sending the Expect header in the HTTP-Artifact binding to improve
performance when the remote party does not support this header.
* Set SameSite attribute to None on on the cookietest cookie.
* Bump default generated keysize to 3072 bits in mellon_create_metadata.
Bug fixes:
* Validate if the assertion ID has not been used earlier before creating
a new session.
* Release session cache after calling invalidate endpoint.
* In MellonCond directives, fix a bug that setting the NC option would
also activate substring match and that REG would activate REF.
* Fix MellonCond substring match to actually match the substring on
the attribute value.
Version 0.16.0
---------------------------------------------------------------------------
Enhancements:
* The MellonCookieSameSite option accepts a new valid "None". This is intended
to be used together with "MellonSecureCookie On". With some newer browsers,
only cookies with "SameSite=None; Secure" would be available for cross-site
access.
* A new option MellonEnabledInvalidateSessionEndpoint was added. When this
option is enabled, then a user can invalidate their session locally by
calling the "/invalidate" endpoint.
Version 0.15.0
---------------------------------------------------------------------------
Security fixes:
* [CVE-2019-13038] Redirect URL validation bypass
Version 0.14.1 and older of mod_auth_mellon allows the redirect URL
validation to be bypassed by specifying an URL formatted as
"http:www.hostname.com". In this case, the APR parsing utility
would parse the scheme as http, host as NULL and path as www.hostname.com.
Browsers, however, interpret the URL differently and redirect to
www.hostname.com. This could be reproduced with:
https://application.com/mellon/login?ReturnTo=http:www.hostname.com
This version fixes that issue by rejecting all URLs with
scheme, but no host name.
Enhancements:
* A XSLT script that allows converting attribute maps from Shibboleth
to a set of MellonSetEnvNoPrefix entries was added. The script can
be found at doc/mellon-attribute-map.xsl
* A new configuration option MellonEnvPrefix was added. This option allows
you to configure the variable prefix, which normally defaults to MELLON_
* A new configuration option MellonAuthnContextComparisonType was added.
This option allows you to set the "Comparison" attribute within
the AuthnRequest
Notable bug fixes:
* Compilation issues on Solaris were fixed
dcd96984d9