[GSS](7.1.z) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml for the picketlink-sts

<PicketLinkSTS xmlns="urn:picketlink:identity-federation:config:1.0"
	STSName="PicketLinkSTS" TokenTimeout="7200" EncryptToken="false">
	<KeyProvider ClassName="org.picketlink.identity.federation.core.impl.KeyStoreKeyManager">
		<Auth Key="KeyStoreURL" Value="sts_keystore.jks"/> 
                <Auth Key="KeyStoreURL"     Value="${idp.keystore.url::sts.jks}"/>
                <Auth Key="KeyStorePass"    Value="${idp.keystore.password::imapassword}"/>
                <Auth Key="SigningKeyAlias" Value="${idp.keystore.alias::idpalias}"/>
                <Auth Key="SigningKeyPass"  Value="${idp.keystore.alias.password::imapassword}"/> 
               <ValidatingAlias Key="http://services.testcorp.org/provider1" Value="service1"/>
	</KeyProvider>
	<TokenProviders>
            <TokenProvider ProviderClass="org.picketlink.identity.federation.core.wstrust.plugins.saml.SAML11TokenProvider"
                TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1"
	        TokenElement="Assertion"
	        TokenElementNS="urn:oasis:names:tc:SAML:1.0:assertion"/>
            <TokenProvider ProviderClass="org.picketlink.identity.federation.core.wstrust.plugins.saml.SAML20TokenProvider"
                TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"
	        TokenElement="Assertion"
	        TokenElementNS="urn:oasis:names:tc:SAML:2.0:assertion"/>
	</TokenProviders>
	<ServiceProviders>
		<ServiceProvider Endpoint="http://services.testcorp.org/provider1" TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"
			TruststoreAlias="service1"/>
	</ServiceProviders>
</PicketLinkSTS>
...