You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "Simon Billingsley (Jira)" <ji...@apache.org> on 2021/03/01 11:39:00 UTC
[jira] [Updated] (AMQ-8159) High severity security issues found in
Apache Shiro v.1.7.0
[ https://issues.apache.org/jira/browse/AMQ-8159?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Simon Billingsley updated AMQ-8159:
-----------------------------------
Description:
Apache ActiveMQ v5.16.1 uses Apache Shiro v1.7.0 which has the following security issues.
I would like to find out when you will be upgrading to Apache Shiro v1.7.1, if ActiveMQ v5.16.2 will include this and if so, when 5.16.2 will be released.
|{color:#000000}*Apache Shiro*{color}|{color:#000000}1.7.0{color}|{color:#000000}org.apache.shiro:shiro-spring:1.7.0{color}|{color:#000000}HIGH{color}|{color:#000000}9.0{color}|{color:#000000}CVE-2020-17523{color}|{color:#000000}2021-02-03T17:15:00.000Z{color}|{color:#000000}Apache Shiro before 1.7.1 when using Apache Shiro with Spring a specially crafted HTTP request may cause an authentication bypass.{color}|
was:
Apache ActiveMQ v5.16.1 uses Apache Shiro v1.7.0 which has the following security issues.
I would like to find out when you will be upgrading to Apache Shiro v1.7.1, if ActiveMQ v5.16.2 will include this and if so, when 5.16.2 will be released.
|{color:#000000}*Apache Shiro*{color}|{color:#000000}1.7.0{color}|{color:#000000}org.apache.shiro:shiro-spring:1.7.0{color}|{color:#000000}HIGH{color}|{color:#000000}9.0{color}|{color:#000000}CVE-2020-17523{color}|{color:#000000}2021-02-03T17:15:00.000Z{color}|{color:#000000}Apache Shiro before 1.7.1 when using Apache Shiro with Spring a specially crafted HTTP request may cause an authentication bypass.{color}|
|{color:#000000}*Apache Shiro*{color}|{color:#000000}1.7.0{color}|{color:#000000}org.apache.shiro:shiro-core:1.7.0{color}|{color:#000000}HIGH{color}|{color:#000000}9.0{color}|{color:#000000}CVE-2020-17523{color}|{color:#000000}2021-02-03T17:15:00.000Z{color}|{color:#000000}Apache Shiro before 1.7.1 when using Apache Shiro with Spring a specially crafted HTTP request may cause an authentication bypass.{color}|
> High severity security issues found in Apache Shiro v.1.7.0
> -----------------------------------------------------------
>
> Key: AMQ-8159
> URL: https://issues.apache.org/jira/browse/AMQ-8159
> Project: ActiveMQ
> Issue Type: Bug
> Components: Broker
> Affects Versions: 5.16.1
> Environment: Linux Bare-Metal and Docker/Kubernetes
> Reporter: Simon Billingsley
> Priority: Major
>
> Apache ActiveMQ v5.16.1 uses Apache Shiro v1.7.0 which has the following security issues.
> I would like to find out when you will be upgrading to Apache Shiro v1.7.1, if ActiveMQ v5.16.2 will include this and if so, when 5.16.2 will be released.
> |{color:#000000}*Apache Shiro*{color}|{color:#000000}1.7.0{color}|{color:#000000}org.apache.shiro:shiro-spring:1.7.0{color}|{color:#000000}HIGH{color}|{color:#000000}9.0{color}|{color:#000000}CVE-2020-17523{color}|{color:#000000}2021-02-03T17:15:00.000Z{color}|{color:#000000}Apache Shiro before 1.7.1 when using Apache Shiro with Spring a specially crafted HTTP request may cause an authentication bypass.{color}|
--
This message was sent by Atlassian Jira
(v8.3.4#803005)