Source: shiro X-Debbugs-CC: t...@security.debian.org Severity: normal Tags: security
Hi, The following vulnerability was published for shiro. CVE-2023-22602[0]: | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, | a specially crafted HTTP request may cause an authentication bypass. | The authentication bypass occurs when Shiro and Spring Boot are using | different pattern-matching techniques. Both Shiro and Spring Boot < | 2.6 default to Ant style pattern matching. Mitigation: Update to | Apache Shiro 1.11.0, or set the following Spring Boot configuration | value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher` https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl Given that we don't include Spring Boot in Debian, this has little impact. I doubt mixing Shiro as packaged in Debian with an externally deployed Spring Boot is any realistic scenario... If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-22602 https://www.cve.org/CVERecord?id=CVE-2023-22602 Please adjust the affected versions in the BTS as needed.