USN-7139-1: Apache Shiro vulnerability
Published Dec 5, 2024
·Updated
It was discovered that Apache Shiro used a static cipher within the "Remember Me" feature inside authentication by default. An attacker could possibly use this issue to achieve remote code execution or obtain sensitive information.
Affected Software
2 affected componentsFixes available
All of the following
ubuntu/libshiro-java<1.2.4-1ubuntu0.1~esm1
1.2.4-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
Event History
Dec 5, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-7139-1?
USN-7139-1 is classified as high severity due to the potential for remote code execution and sensitive information exposure.
2
How do I fix USN-7139-1?
To fix USN-7139-1, upgrade to the patched version libshiro-java 1.2.4-1ubuntu0.1~esm1.
3
Which software versions are affected by USN-7139-1?
USN-7139-1 affects the libshiro-java package on Ubuntu 16.04.
4
What vulnerability does USN-7139-1 address?
USN-7139-1 addresses a vulnerability in Apache Shiro related to a static cipher in its "Remember Me" authentication feature.
5
Can USN-7139-1 lead to data breaches?
Yes, USN-7139-1 can potentially lead to data breaches if exploited, enabling attackers to access sensitive information.