xmltooling (3.0.4-1) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/shib-team/xmltooling.git
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: debian/master
Path: debian/changelog
Browser: https://salsa.debian.org/shib-team/xmltooling
Last scan: 2019-09-20 04:55:30+00
Next scan: 2019-09-25 18:16:00+00

Debian changelog in Git:

xmltooling (3.0.4-1) unstable; urgency=high

  * [f185b26] New upstream security release: 3.0.4
    DSA-4407-1, CVE-2019-9628: uncaught exception on malformed XML
    declaration.
    Invalid data in the XML declaration causes an exception of a type
    that was not handled properly in the parser class and propagates an
    unexpected exception type.
    This generally manifests as a crash in the calling code, which in the
    Service Provider software's case is usually the shibd daemon process,
    but can be Apache in some cases. Note that the crash occurs prior to
    evaluation of a message's authenticity, so can be exploited by an
    untrusted attacker.
    https://shibboleth.net/community/advisories/secadv_20190311.txt
    https://issues.shibboleth.net/jira/browse/CPPXT-143
    Thanks to Scott Cantor (Closes: #924346)

 -- Ferenc Wágner <wferi@debian.org>  Thu, 14 Mar 2019 14:58:36 +0100

This branch is even with tag debian/3.0.4-1