Bug#1014820: shiro: CVE-2022-32532
Moritz Mühlenhoff
jmm at inutil.org
Tue Jul 12 15:34:40 BST 2022
Source: shiro
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for shiro.
CVE-2022-32532[0]:
| Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured
| to be bypassed on some servlet containers. Applications using
| RegExPatternMatcher with `.` in the regular expression are possibly
| vulnerable to an authorization bypass.
https://www.openwall.com/lists/oss-security/2022/06/28/2
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-32532
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32532
Please adjust the affected versions in the BTS as needed.
More information about the pkg-java-maintainers
mailing list