Summary
It was discovered that Apache Shiro incorrectly handled certain HTTP
requests. A remote attacker could possibly use this issue to bypass
security restrictions. (CVE-2020-13933, CVE-2020-17510)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | shiro | 1.3.2-4ubuntu0.2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | shiro | 1.3.2-3ubuntu0.18.04.1~esm1 |
Vulnerabilities 2
-
Critical 9.8
Authentication bypass in Apache Shiro
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
-
High 7.5
Authentication bypass in Apache Shiro
Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.