USN-9061-1: shiro vulnerabilities
It was discovered that Apache Shiro incorrectly handled certain specially crafted requests when used with Spring dynamic controllers. A remote attacker could possibly use this issue to bypass authentication. (CVE-2020-1957, CVE-2020-11989)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/shiroto a version that resolves this vulnerability.Fixed in 1.2.4-1ubuntu0.1~esm1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Apache Shiro together with Spring dynamic controllers are the affected scenario described in the notice.
What does an attacker need to exploit it?
An attacker would need to send specially crafted requests to the affected application remotely. Successful exploitation could allow authentication to be bypassed.
What is the potential impact if the issue is exploited?
The reported impact is an authentication bypass, which could let a remote attacker access functionality that should require authentication.