USN-7147-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-7147-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7147-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/USN-7147-1
Related
Published
2024-12-10T18:08:44.082087Z
Modified
2024-12-10T18:08:44.082087Z
Summary
shiro vulnerabilities
Details

It was discovered that Apache Shiro incorrectly handled path traversal when used with other web frameworks or path rewriting. An attacker could possibly use this issue to obtain sensitive information or administrative privileges. This update provides the corresponding fix for Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-34478, CVE-2023-46749)

It was discovered that Apache Shiro incorrectly handled web redirects when used together with the form authentication method. An attacker could possibly use this issue to perform phishing attacks. This update provides the corresponding fix for Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-46750)

It was discovered that Apache Shiro incorrectly handled requests through servlet filtering. An attacker could possibly use this issue to obtain administrative privileges. This update provides the corresponding fix for Ubuntu 16.04 LTS. (CVE-2016-6802)

References

Affected packages

Ubuntu:Pro:16.04:LTS / shiro

Package

Name
shiro
Purl
pkg:deb/ubuntu/shiro?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.4-1ubuntu0.1~esm2

Affected versions

1.*

1.2.4-1
1.2.4-1ubuntu0.1~esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "libshiro-java"
        }
    ]
}

Ubuntu:24.10 / shiro

Package

Name
shiro
Purl
pkg:deb/ubuntu/shiro?arch=src?distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2-5ubuntu0.24.10.1

Affected versions

1.*

1.3.2-5

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.3.2-5ubuntu0.24.10.1",
            "binary_name": "libshiro-java"
        }
    ]
}

Ubuntu:Pro:24.04:LTS / shiro

Package

Name
shiro
Purl
pkg:deb/ubuntu/shiro?arch=src?distro=esm-apps/noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.2-5ubuntu0.24.04.1~esm1

Affected versions

1.*

1.3.2-5

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.3.2-5ubuntu0.24.04.1~esm1",
            "binary_name": "libshiro-java"
        }
    ]
}