UBUNTU-CVE-2020-1957: Critical severity ubuntu/shiro vulnerability
Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/shiroto a version that resolves this vulnerability.Fixed in 1.3.2-3~18.04.1 - Upgrade
Upgrade
ubuntu/shiroto a version that resolves this vulnerability.Fixed in 1.3.2-4ubuntu0.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Apache Shiro before 1.5.2 with Spring dynamic controllers are affected.
What access does an attacker need?
The vulnerability is remotely exploitable with low attack complexity and does not require prior privileges or user interaction.
How can I determine whether my application needs remediation?
Check whether the application uses Apache Shiro earlier than 1.5.2 and whether it uses Spring dynamic controllers. If both conditions apply, the deployment is affected.
What version addresses the issue?
Apache Shiro 1.5.2 or later is not included in the affected version range described for this issue.