You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2016/06/19 22:30:06 UTC
svn commit: r1749220 - in /ofbiz/trunk: .classpath LICENSE build.xml
framework/base/lib/shiro-core-1.2.3.jar
framework/base/lib/shiro-core-1.2.5.jar
Author: jleroux
Date: Sun Jun 19 22:30:06 2016
New Revision: 1749220
URL: http://svn.apache.org/viewvc?rev=1749220&view=rev
Log:
Updates Shiro to 1.2.5 (CVE-2016-4437) - https://issues.apache.org/jira/browse/OFBIZ-7373
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Details at https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4437
Added:
ofbiz/trunk/framework/base/lib/shiro-core-1.2.5.jar (with props)
Removed:
ofbiz/trunk/framework/base/lib/shiro-core-1.2.3.jar
Modified:
ofbiz/trunk/.classpath
ofbiz/trunk/LICENSE
ofbiz/trunk/build.xml
Modified: ofbiz/trunk/.classpath
URL: http://svn.apache.org/viewvc/ofbiz/trunk/.classpath?rev=1749220&r1=1749219&r2=1749220&view=diff
==============================================================================
--- ofbiz/trunk/.classpath (original)
+++ ofbiz/trunk/.classpath Sun Jun 19 22:30:06 2016
@@ -43,7 +43,7 @@
<classpathentry kind="lib" path="framework/base/lib/owasp-java-html-sanitizer-r239.jar"/>
<classpathentry kind="lib" path="framework/base/lib/resolver-2.9.1.jar"/>
<classpathentry kind="lib" path="framework/base/lib/serializer-2.9.1.jar"/>
- <classpathentry kind="lib" path="framework/base/lib/shiro-core-1.2.3.jar"/>
+ <classpathentry kind="lib" path="framework/base/lib/shiro-core-1.2.5.jar"/>
<classpathentry kind="lib" path="framework/base/lib/slf4j-api-1.6.4.jar"/>
<classpathentry kind="lib" path="framework/base/lib/tika-core-1.12.jar"/>
<classpathentry kind="lib" path="framework/base/lib/tika-parsers-1.12.jar"/>
Modified: ofbiz/trunk/LICENSE
URL: http://svn.apache.org/viewvc/ofbiz/trunk/LICENSE?rev=1749220&r1=1749219&r2=1749220&view=diff
==============================================================================
--- ofbiz/trunk/LICENSE (original)
+++ ofbiz/trunk/LICENSE Sun Jun 19 22:30:06 2016
@@ -42,7 +42,7 @@ framework/base/lib/nekohtml-1.9.16.jar
framework/base/lib/pdfbox-1.8.12.jar
framework/base/lib/resolver-2.9.1.jar
framework/base/lib/serializer-2.9.1.jar
-framework/base/lib/shiro-core-1.2.3.jar
+framework/base/lib/shiro-core-1.2.5.jar
framework/base/lib/tika-core-1.12.jar
framework/base/lib/tika-parsers-1.12.jar
framework/base/lib/ws-commons-java5-1.0.1.jar
Modified: ofbiz/trunk/build.xml
URL: http://svn.apache.org/viewvc/ofbiz/trunk/build.xml?rev=1749220&r1=1749219&r2=1749220&view=diff
==============================================================================
--- ofbiz/trunk/build.xml (original)
+++ ofbiz/trunk/build.xml Sun Jun 19 22:30:06 2016
@@ -1477,7 +1477,7 @@ under the License.
<classpath>
<path location="framework/base/build/lib/ofbiz-base.jar"/>
<path location="framework/base/lib/commons/commons-codec-1.10.jar"/>
- <path location="framework/base/lib/shiro-core-1.2.3.jar"/>
+ <path location="framework/base/lib/shiro-core-1.2.5.jar"/>
<path location="framework/base/lib/slf4j-api-1.6.4.jar"/>
</classpath>
</java>
Added: ofbiz/trunk/framework/base/lib/shiro-core-1.2.5.jar
URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/base/lib/shiro-core-1.2.5.jar?rev=1749220&view=auto
==============================================================================
Binary file - no diff available.
Propchange: ofbiz/trunk/framework/base/lib/shiro-core-1.2.5.jar
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream