oss-security - CVE-2021-41303: Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAH9eYVrHUMa9_E7ZHb=shpMS18TF7MXkM_9mcpJbcCTG8b6z3Q@mail.gmail.com>
Date: Thu, 16 Sep 2021 16:19:53 -0400
From: Brian Demers <bdemers@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-41303: Apache Shiro before 1.8.0, when using Apache Shiro
 with Spring Boot, a specially crafted HTTP request may cause an
 authentication bypass

Description:

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a
specially crafted HTTP request may cause an authentication bypass.

Users should update to Apache Shiro 1.8.0.

Credit:

Apache Shiro would like to thank tsug0d for reporting this issue.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.