<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Version <b class="">1.1.19</b> has just been released to Maven Central. This release fixes a critical security vulnerability that can allow remote execution of system commands on the server through a well crafted URI parameter to the authorization endpoint. Details on the exploit can be found in <span style="font-family: Arial, sans-serif; font-size: 13px;" class="">CVE-2015-7864.</span><div class=""><font face="Arial, sans-serif" size="2" class=""><br class=""></font></div><div class=""><font face="Arial, sans-serif" size="2" class="">This release also includes a fix to SNI support. <br class=""></font><div class=""><br class=""></div><div class="">The 1.2 series of releases is not affected by this exploit. (In fact, 1.1 was fixed by backporting some changes from 1.2). </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><b class="">Immediate upgrade is strongly encouraged.</b></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""> — Justin</div></div></body></html>