UBUNTU-CVE-2020-11989: Critical severity ubuntu/shiro vulnerability

Q: Which deployments are exposed to this issue?

Deployments using Apache Shiro with Spring dynamic controllers are affected if they use a Shiro version before 1.5.3.

Q: What does an attacker need to exploit the vulnerability?

The listed vector indicates exploitation can be performed remotely with low attack complexity, without privileges or user interaction. A specially crafted request is used to trigger the authentication bypass.

Q: What is the remediation?

Upgrade Apache Shiro to version 1.5.3 or later. The provided data does not identify a workaround for systems that cannot be patched immediately.

Published Jun 22, 2020

Updated

Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Affected Software

2 affected componentsFixes available

ubuntu/shiro<1.3.2-3~18.04.1

1.3.2-3~18.04.1

ubuntu/shiro<1.3.2-4ubuntu0.1

1.3.2-4ubuntu0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/shiro to a version that resolves this vulnerability.
Fixed in 1.3.2-3~18.04.1
Upgrade
Upgrade ubuntu/shiro to a version that resolves this vulnerability.
Fixed in 1.3.2-4ubuntu0.1

Event History

Jun 22, 2020

CVE Published

via OSV·07:15 PM

Data Sourced

via OSV·07:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Apache Shiro with Spring dynamic controllers are affected if they use a Shiro version before 1.5.3.

What does an attacker need to exploit the vulnerability?