[security-dev] PicketLink 2.7 and XXE
bentmann at sonatype.com
Fri Aug 8 09:30:41 EDT 2014
a couple days back , I noticed that PicketLink 2.7.0.Beta1 was
released but seems to miss changes to its DocumentUtil to disable entity
expansion as done for e.g. the 2.6.x branch.
I'm not sure whether my Github comment reached anybody so I figured I
make another attempt via this channel to ensure the potential issue
doesn't fall through the cracks.
More information about the security-dev