Debian Package Tracker

A new upstream version is available: 1.4.2 high

A new upstream version 1.4.2 is available, you should consider packaging it.

Created: 2017-11-21 Last update: 2019-12-12 13:36

1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:

CVE-2019-12422: Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

Please fix it.

Created: 2019-11-19 Last update: 2019-11-20 06:34

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2019-12422: Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

Please fix it.

Created: 2019-11-19 Last update: 2019-11-20 06:34

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2019-12422: Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

Please fix it.

Created: 2019-11-19 Last update: 2019-11-20 06:34

3 security issues in jessie high

There are 3 open security issues in jessie.

1 important issue:

CVE-2019-12422: Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

2 issues skipped by the security teams:

CVE-2016-4437: Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CVE-2016-6802: Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.

Please fix them.

Created: 2016-06-04 Last update: 2019-11-20 06:34

1 security issue in stretch high

There is 1 open security issue in stretch.

1 important issue:

CVE-2019-12422: Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

Please fix it.

Created: 2019-11-19 Last update: 2019-11-20 06:34

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.1 instead of 4.3.0).

Created: 2019-07-08 Last update: 2019-09-29 23:39

shiro