Work item search - Shibboleth Jira

OSJ-427

Simple signature verification fails to detect parameter smuggling

Brent Putman

Scott Cantor

Highest

Fixed

Mar 10, 2025, 6:11 PM

Mar 27, 2025, 2:17 PM

OSJ-416

Test coverage for disallowed encryption or signing algorithms

Brent Putman

Scott Cantor

Highest

Unresolved

Sep 17, 2024, 2:22 PM

Sep 20, 2024, 1:41 PM

OSJ-408

Review effects of Bouncy Castle 1.78's change to PEM parsing

Brent Putman

Ian Young

Highest

Unresolved

Jul 29, 2024, 4:50 PM

Aug 16, 2024, 3:19 PM

OSJ-400

Failure in OpenSAML tests with Santuario xmlsec 3.0.4

Brent Putman

Ian Young

Trivial

Fixed

Feb 29, 2024, 4:59 PM

Dec 18, 2024, 6:22 PM

OSJ-391

Default supported TLS protocols appears too broad

Brent Putman

Scott Cantor

Trivial

Done

Oct 12, 2023, 5:19 PM

Mar 13, 2024, 2:44 PM

OSJ-390

Investigate possibility of HttpClient connection reuse with our custom TLS handling

Brent Putman

Trivial

Unresolved

Sep 01, 2023, 12:21 AM

Mar 13, 2024, 2:42 PM

OSJ-388

Update RSASSA-PSS AlgorithmDescriptors when Santuario updates their methodology

Brent Putman

Trivial

Completed

Aug 30, 2023, 3:17 AM

Oct 23, 2023, 5:36 PM

OSJ-385

Investigate update to Santuario XML Security 3.x

Brent Putman

Trivial

Completed

Aug 18, 2023, 2:22 PM

Aug 31, 2023, 11:56 PM

OSJ-384

HTTP client changes to allow for preemptive basic auth

Brent Putman

Scott Cantor

Trivial

Completed

Jul 24, 2023, 2:51 PM

Sep 01, 2023, 12:05 AM

OSJ-378

Logging on AlgorithmSupport "failures" should be DEBUG

Brent Putman

Scott Cantor

Trivial

Fixed

May 17, 2023, 12:26 AM

Jul 31, 2023, 11:52 PM

OSJ-374

AlgorithmRegistry indexes signing algorithms only by key type + digest

Brent Putman

Trivial

Completed

Feb 02, 2023, 2:32 AM

Aug 04, 2023, 4:07 AM

OSJ-373

Investigate adding support for signing with RSASSA-PSS with parameters

Brent Putman

Trivial

Unresolved

Feb 02, 2023, 2:25 AM

Mar 13, 2024, 2:42 PM

OSJ-372

Add support for newer signing and/or encryption algorithms

Brent Putman

Trivial

Completed

Feb 02, 2023, 2:21 AM

Sep 15, 2023, 3:23 PM

OSJ-367

Decrypter does not guard against malicious references or transforms

Brent Putman

Scott Cantor

Major

Fixed

Dec 12, 2022, 5:47 PM

Jan 11, 2023, 11:48 PM

OSJ-365

BasicX509Credential has a race condition around certificate access

Scott Cantor

Trivial

Fixed

Nov 14, 2022, 3:10 PM

Jan 18, 2023, 1:22 PM

OSJ-362

Add support for dynamic config to Decrypter

Brent Putman

Scott Cantor

Trivial

Completed

Oct 18, 2022, 1:24 PM

Aug 02, 2023, 7:23 AM

OSJ-361

Add lookup strategy for obtaining EncryptedKeyResolver recipients.

Unassigned

Scott Cantor

Trivial

Won't Do

Oct 18, 2022, 12:40 PM

Oct 18, 2022, 1:01 PM

OSJ-360

Regenerate PKIX test certs with SHA-2

Brent Putman

Scott Cantor

Blocker

Completed

Sep 08, 2022, 4:59 PM

Jan 18, 2023, 1:22 PM

OSJ-355

ConcatKDF parameter requirements too restrictive in ECDH

Brent Putman

Stefan Santesson

Trivial

Fixed

Jun 27, 2022, 12:51 PM

Sep 14, 2023, 11:43 PM

OSJ-353

Move IdP Spring support for credentials/trust into new module

Scott Cantor

Trivial

Done

Jun 08, 2022, 2:43 PM

Sep 13, 2023, 1:37 PM

OSJ-351

Tweak AbstractEncryptedKeyResolver to be more subclass friendly.

Scott Cantor

Trivial

Done

Apr 05, 2022, 5:42 PM

Apr 15, 2022, 5:05 PM

OSJ-348

SAML Assertion signature validation should evaluate algorithm policy

Brent Putman

Major

Fixed

Jan 27, 2022, 3:14 AM

Mar 02, 2022, 11:38 PM

OSJ-344

Exclude JAXB from xmlsec dependencies

Brent Putman

Scott Cantor

Trivial

Completed

Oct 20, 2021, 2:14 PM

Mar 29, 2022, 9:15 PM

OSJ-335

X.509 certificate access should include support for jakarta attribute

Brent Putman

Scott Cantor

Major

Completed

Apr 21, 2021, 1:43 PM

Mar 04, 2022, 3:30 PM

OSJ-333

Support encryption via classic Diffie-Hellman key agreement

Brent Putman

Minor

Completed

Mar 10, 2021, 1:35 AM

Mar 10, 2021, 1:38 AM

OSJ-326

Decrypter does not log the decrypted XML

Scott Cantor

Major

Fixed

Oct 26, 2020, 7:48 PM

Oct 26, 2020, 8:21 PM

OSJ-323

HttpClient configured TLS trust engine is not evaluated on TLS session resumption

Brent Putman

Paul B. Henson

Major

Fixed

Aug 18, 2020, 12:45 AM

Nov 13, 2020, 8:03 PM

OSJ-319

Test failure: Legacy SunEC curve disabled under Java 15

Brent Putman

Ian Young

Major

Fixed

Jun 19, 2020, 10:04 AM

Sep 18, 2020, 1:56 PM

OSJ-318

Deprecate terms from classes and configuration

Brent Putman

Scott Cantor

Major

Completed

Jun 09, 2020, 3:01 PM

Mar 19, 2021, 6:32 PM

OSJ-315

Update xmlsec to 2.3

Brent Putman

Scott Cantor

Minor

Done

May 26, 2020, 1:33 PM

Apr 15, 2022, 5:06 PM

OSJ-307

Support Santuario's XMLParser interface

Brent Putman

Scott Cantor

Major

Completed

Apr 03, 2020, 3:12 PM

Aug 18, 2023, 1:19 AM

OSJ-299

Enhance AlgorithmRegistry to support lookup by AlgorithmType

Brent Putman

Major

Completed

Feb 12, 2020, 11:30 PM

Feb 14, 2020, 11:26 PM

OSJ-290

Deterministic selection of encryption keys from metadata

Brent Putman

Scott Cantor

Major

Duplicate

Nov 06, 2019, 3:56 PM

Nov 06, 2019, 9:35 PM

OSJ-289

DecryptAssertions/Attributes using unsupported list removals

Scott Cantor

Major

Fixed

Nov 05, 2019, 9:48 PM

Mar 11, 2020, 2:10 PM

OSJ-287

Get off Santuario Base64 encoder class

Scott Cantor

Major

Fixed

Oct 17, 2019, 12:39 PM

Mar 11, 2020, 2:10 PM

OSJ-282

SignatureValidator initialization concurrency issue

Brent Putman

Unidentified Legacy Account

Critical

Fixed

Sep 13, 2019, 7:13 PM

Jun 24, 2021, 1:59 PM

OSJ-281

check stricter algorithm names in Java 14

Brent Putman

Ian Young

Major

Answered

Aug 19, 2019, 4:04 PM

Aug 24, 2019, 1:41 AM

OSJ-279

tests failing algorithm constraints under RHEL 8

Ian Young

Major

Fixed

Jul 23, 2019, 2:13 PM

Sep 17, 2019, 5:57 PM

OSJ-277

Switch to LinkedHashSet and metadata document order on encryption keys

Brent Putman

Scott Cantor

Major

Completed

Apr 12, 2019, 4:15 PM

Nov 06, 2019, 9:20 PM

OSJ-273

javax.security.cert.X509Certificate deprecated for removal in Java 13

Brent Putman

Ian Young

Major

Fixed

Apr 04, 2019, 11:04 AM

Feb 19, 2020, 1:11 AM

OSJ-270

KeyLengthCriterion not set in Decrypter

Brent Putman

Unidentified Legacy Account

Critical

Fixed

Mar 15, 2019, 7:46 AM

Aug 06, 2021, 10:29 PM

OSJ-265

TLS socket factory clears client TLS credential too early

Brent Putman

Jim Fox

Major

Fixed

Jan 23, 2019, 9:19 PM

Apr 29, 2019, 9:29 PM

OSJ-245

Uncaught exception handling invalid certificates during encryption setup

Brent Putman

Scott Cantor

Major

Fixed

Apr 20, 2018, 8:34 PM

Sep 12, 2018, 1:40 AM

OSJ-238

Internal ParserPool built by Decrypter

Brent Putman

Scott Cantor

Blocker

Fixed

Apr 16, 2018, 2:01 PM

Sep 11, 2018, 1:15 AM

OSJ-230

Expose signing parameter to control ContentReference c14n algorithm

Brent Putman

Scott Cantor

Major

Completed

Feb 07, 2018, 4:57 PM

Jun 23, 2021, 9:48 PM

OSJ-227

Failure to load seemingly correct EC keypairs

Daniel Fisher

Scott Cantor

Major

Fixed

Nov 29, 2017, 5:23 PM

Oct 09, 2018, 6:01 PM

OSJ-220

enable unlimited crypto under Java 9 and latest Java 8

Brent Putman

Ian Young

Major

Won't Do

Sep 25, 2017, 5:08 PM

Sep 21, 2018, 4:14 PM

OSJ-215

Improve crypto-related tests to run correctly when unlimited JCE policy not installed

Brent Putman

Minor

Won't Do

Aug 31, 2017, 11:32 PM

Sep 21, 2018, 4:15 PM

OSJ-209

Support mandatory use of TrustEngine in SecurityEnhancedTLSSocketFactory

Brent Putman

Scott Cantor

Major

Completed

May 27, 2017, 4:43 PM

Aug 05, 2017, 12:22 AM

OSJ-192

Regenerate unit test certs and CAs having MD5 algorithms

Brent Putman

Minor

Completed

Jan 18, 2017, 9:22 PM

Oct 04, 2017, 1:31 PM

Work	Assignee	Reporter	Priority	Resolution	Created	Updated
OSJ-427 Simple signature verification fails to detect parameter smuggling	Brent Putman	Scott Cantor	Highest	Fixed	Mar 10, 2025, 6:11 PM	Mar 27, 2025, 2:17 PM
OSJ-416 Test coverage for disallowed encryption or signing algorithms	Brent Putman	Scott Cantor	Highest	Unresolved	Sep 17, 2024, 2:22 PM	Sep 20, 2024, 1:41 PM
OSJ-408 Review effects of Bouncy Castle 1.78's change to PEM parsing	Brent Putman	Ian Young	Highest	Unresolved	Jul 29, 2024, 4:50 PM	Aug 16, 2024, 3:19 PM
OSJ-400 Failure in OpenSAML tests with Santuario xmlsec 3.0.4	Brent Putman	Ian Young	Trivial	Fixed	Feb 29, 2024, 4:59 PM	Dec 18, 2024, 6:22 PM
OSJ-391 Default supported TLS protocols appears too broad	Brent Putman	Scott Cantor	Trivial	Done	Oct 12, 2023, 5:19 PM	Mar 13, 2024, 2:44 PM
OSJ-390 Investigate possibility of HttpClient connection reuse with our custom TLS handling	Brent Putman	Brent Putman	Trivial	Unresolved	Sep 01, 2023, 12:21 AM	Mar 13, 2024, 2:42 PM
OSJ-388 Update RSASSA-PSS AlgorithmDescriptors when Santuario updates their methodology	Brent Putman	Brent Putman	Trivial	Completed	Aug 30, 2023, 3:17 AM	Oct 23, 2023, 5:36 PM
OSJ-385 Investigate update to Santuario XML Security 3.x	Brent Putman	Brent Putman	Trivial	Completed	Aug 18, 2023, 2:22 PM	Aug 31, 2023, 11:56 PM
OSJ-384 HTTP client changes to allow for preemptive basic auth	Brent Putman	Scott Cantor	Trivial	Completed	Jul 24, 2023, 2:51 PM	Sep 01, 2023, 12:05 AM
OSJ-378 Logging on AlgorithmSupport "failures" should be DEBUG	Brent Putman	Scott Cantor	Trivial	Fixed	May 17, 2023, 12:26 AM	Jul 31, 2023, 11:52 PM
OSJ-374 AlgorithmRegistry indexes signing algorithms only by key type + digest	Brent Putman	Brent Putman	Trivial	Completed	Feb 02, 2023, 2:32 AM	Aug 04, 2023, 4:07 AM
OSJ-373 Investigate adding support for signing with RSASSA-PSS with parameters	Brent Putman	Brent Putman	Trivial	Unresolved	Feb 02, 2023, 2:25 AM	Mar 13, 2024, 2:42 PM
OSJ-372 Add support for newer signing and/or encryption algorithms	Brent Putman	Brent Putman	Trivial	Completed	Feb 02, 2023, 2:21 AM	Sep 15, 2023, 3:23 PM
OSJ-367 Decrypter does not guard against malicious references or transforms	Brent Putman	Scott Cantor	Major	Fixed	Dec 12, 2022, 5:47 PM	Jan 11, 2023, 11:48 PM
OSJ-365 BasicX509Credential has a race condition around certificate access	Scott Cantor	Scott Cantor	Trivial	Fixed	Nov 14, 2022, 3:10 PM	Jan 18, 2023, 1:22 PM
OSJ-362 Add support for dynamic config to Decrypter	Brent Putman	Scott Cantor	Trivial	Completed	Oct 18, 2022, 1:24 PM	Aug 02, 2023, 7:23 AM
OSJ-361 Add lookup strategy for obtaining EncryptedKeyResolver recipients.	Unassigned	Scott Cantor	Trivial	Won't Do	Oct 18, 2022, 12:40 PM	Oct 18, 2022, 1:01 PM
OSJ-360 Regenerate PKIX test certs with SHA-2	Brent Putman	Scott Cantor	Blocker	Completed	Sep 08, 2022, 4:59 PM	Jan 18, 2023, 1:22 PM
OSJ-355 ConcatKDF parameter requirements too restrictive in ECDH	Brent Putman	Stefan Santesson	Trivial	Fixed	Jun 27, 2022, 12:51 PM	Sep 14, 2023, 11:43 PM
OSJ-353 Move IdP Spring support for credentials/trust into new module	Scott Cantor	Scott Cantor	Trivial	Done	Jun 08, 2022, 2:43 PM	Sep 13, 2023, 1:37 PM
OSJ-351 Tweak AbstractEncryptedKeyResolver to be more subclass friendly.	Scott Cantor	Scott Cantor	Trivial	Done	Apr 05, 2022, 5:42 PM	Apr 15, 2022, 5:05 PM
OSJ-348 SAML Assertion signature validation should evaluate algorithm policy	Brent Putman	Brent Putman	Major	Fixed	Jan 27, 2022, 3:14 AM	Mar 02, 2022, 11:38 PM
OSJ-344 Exclude JAXB from xmlsec dependencies	Brent Putman	Scott Cantor	Trivial	Completed	Oct 20, 2021, 2:14 PM	Mar 29, 2022, 9:15 PM
OSJ-335 X.509 certificate access should include support for jakarta attribute	Brent Putman	Scott Cantor	Major	Completed	Apr 21, 2021, 1:43 PM	Mar 04, 2022, 3:30 PM
OSJ-333 Support encryption via classic Diffie-Hellman key agreement	Brent Putman	Brent Putman	Minor	Completed	Mar 10, 2021, 1:35 AM	Mar 10, 2021, 1:38 AM
OSJ-326 Decrypter does not log the decrypted XML	Scott Cantor	Scott Cantor	Major	Fixed	Oct 26, 2020, 7:48 PM	Oct 26, 2020, 8:21 PM
OSJ-323 HttpClient configured TLS trust engine is not evaluated on TLS session resumption	Brent Putman	Paul B. Henson	Major	Fixed	Aug 18, 2020, 12:45 AM	Nov 13, 2020, 8:03 PM
OSJ-319 Test failure: Legacy SunEC curve disabled under Java 15	Brent Putman	Ian Young	Major	Fixed	Jun 19, 2020, 10:04 AM	Sep 18, 2020, 1:56 PM
OSJ-318 Deprecate terms from classes and configuration	Brent Putman	Scott Cantor	Major	Completed	Jun 09, 2020, 3:01 PM	Mar 19, 2021, 6:32 PM
OSJ-315 Update xmlsec to 2.3	Brent Putman	Scott Cantor	Minor	Done	May 26, 2020, 1:33 PM	Apr 15, 2022, 5:06 PM
OSJ-307 Support Santuario's XMLParser interface	Brent Putman	Scott Cantor	Major	Completed	Apr 03, 2020, 3:12 PM	Aug 18, 2023, 1:19 AM
OSJ-299 Enhance AlgorithmRegistry to support lookup by AlgorithmType	Brent Putman	Brent Putman	Major	Completed	Feb 12, 2020, 11:30 PM	Feb 14, 2020, 11:26 PM
OSJ-290 Deterministic selection of encryption keys from metadata	Brent Putman	Scott Cantor	Major	Duplicate	Nov 06, 2019, 3:56 PM	Nov 06, 2019, 9:35 PM
OSJ-289 DecryptAssertions/Attributes using unsupported list removals	Scott Cantor	Scott Cantor	Major	Fixed	Nov 05, 2019, 9:48 PM	Mar 11, 2020, 2:10 PM
OSJ-287 Get off Santuario Base64 encoder class	Scott Cantor	Scott Cantor	Major	Fixed	Oct 17, 2019, 12:39 PM	Mar 11, 2020, 2:10 PM
OSJ-282 SignatureValidator initialization concurrency issue	Brent Putman	Unidentified Legacy Account	Critical	Fixed	Sep 13, 2019, 7:13 PM	Jun 24, 2021, 1:59 PM
OSJ-281 check stricter algorithm names in Java 14	Brent Putman	Ian Young	Major	Answered	Aug 19, 2019, 4:04 PM	Aug 24, 2019, 1:41 AM
OSJ-279 tests failing algorithm constraints under RHEL 8	Ian Young	Ian Young	Major	Fixed	Jul 23, 2019, 2:13 PM	Sep 17, 2019, 5:57 PM
OSJ-277 Switch to LinkedHashSet and metadata document order on encryption keys	Brent Putman	Scott Cantor	Major	Completed	Apr 12, 2019, 4:15 PM	Nov 06, 2019, 9:20 PM
OSJ-273 javax.security.cert.X509Certificate deprecated for removal in Java 13	Brent Putman	Ian Young	Major	Fixed	Apr 04, 2019, 11:04 AM	Feb 19, 2020, 1:11 AM
OSJ-270 KeyLengthCriterion not set in Decrypter	Brent Putman	Unidentified Legacy Account	Critical	Fixed	Mar 15, 2019, 7:46 AM	Aug 06, 2021, 10:29 PM
OSJ-265 TLS socket factory clears client TLS credential too early	Brent Putman	Jim Fox	Major	Fixed	Jan 23, 2019, 9:19 PM	Apr 29, 2019, 9:29 PM
OSJ-245 Uncaught exception handling invalid certificates during encryption setup	Brent Putman	Scott Cantor	Major	Fixed	Apr 20, 2018, 8:34 PM	Sep 12, 2018, 1:40 AM
OSJ-238 Internal ParserPool built by Decrypter	Brent Putman	Scott Cantor	Blocker	Fixed	Apr 16, 2018, 2:01 PM	Sep 11, 2018, 1:15 AM
OSJ-230 Expose signing parameter to control ContentReference c14n algorithm	Brent Putman	Scott Cantor	Major	Completed	Feb 07, 2018, 4:57 PM	Jun 23, 2021, 9:48 PM
OSJ-227 Failure to load seemingly correct EC keypairs	Daniel Fisher	Scott Cantor	Major	Fixed	Nov 29, 2017, 5:23 PM	Oct 09, 2018, 6:01 PM
OSJ-220 enable unlimited crypto under Java 9 and latest Java 8	Brent Putman	Ian Young	Major	Won't Do	Sep 25, 2017, 5:08 PM	Sep 21, 2018, 4:14 PM
OSJ-215 Improve crypto-related tests to run correctly when unlimited JCE policy not installed	Brent Putman	Brent Putman	Minor	Won't Do	Aug 31, 2017, 11:32 PM	Sep 21, 2018, 4:15 PM
OSJ-209 Support mandatory use of TrustEngine in SecurityEnhancedTLSSocketFactory	Brent Putman	Scott Cantor	Major	Completed	May 27, 2017, 4:43 PM	Aug 05, 2017, 12:22 AM
OSJ-192 Regenerate unit test certs and CAs having MD5 algorithms	Brent Putman	Brent Putman	Minor	Completed	Jan 18, 2017, 9:22 PM	Oct 04, 2017, 1:31 PM

All work