Source: shiro
Severity: grave
Tags: security
The following was reported on oss-security. shiro doesn't seem to have
any rdeps in Debian.
Cheers,
Moritz
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
1.0.0-incubating - 1.2.4
Description:
A default cipher key is used for the "remember me" feature when not
explicitly configured. A request that included a specially crafted
request
parameter could be used to execute arbitrary code or access content
that
would otherwise be protected by a security constraint.
Mitigation:
Users should upgrade to 1.2.5 [1], ensure a secret cipher key is
configured [2], or disable the "remember me" feature. [3]
All binaries (.jars) are available in Maven Central already.
References:
[1] http://shiro.apache.org/download.html
[2]
http://shiro.apache.org/configuration.html#Configuration-ByteArrayValues
[3] If using a shiro.ini, "remember me" can be disabled adding the
following config line in the '[main]' section:
securityManager.rememberMeManager = null
__
This is the maintainer address of Debian's Java team
<http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>.
Please use
debian-j...@lists.debian.org for discussions and questions.
