| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAH9eYVrCp8pGXJiZM2F-9-h2z-hk+gGSk5GkhLs_wf-E_DVQ5Q@mail.gmail.com>
Date: Mon, 3 Mar 2014 10:14:52 -0500
From: Brian Demers <brian.demers@...il.com>
To: "user@...ro.apache.org" <user@...ro.apache.org>, dev@...ro.apache.org,
"security@...che.org" <security@...che.org>, full-disclosure@...ts.grok.org.uk,
bugtraq@...urityfocus.com
Subject: [Announce] Apache Shiro 1.2.3 Released - Security
Advisory
Dear Apache Shiro Community,
The Apache Shiro team has released Apache Shiro version 1.2.3. This is the
third bug fix point release after 1.2.0.
All binaries (.jars) are available in Maven Central already.
This release includes 1 critical vulnerability and is available for
Download [1] now.
SHIRO-460 - LDAP authentication succeeds even if the user name and
password is not passed. [2] [CVE-2014-0074]
Versions Affected:
1.0.0-incubating - 1.2.2
Details:
When using an LDAP server that allows unauthenticated bind, Shiro will
authenticate users with an empty password.
NOTE: this is NOT the default for OpenLDAP
Mitigation:
Users should upgrade to 1.2.3
Workaround:
Disable unauthenticated binds on your LDAP server (best practice).
Cheers,
The Apache Shiro Team
[1] http://shiro.apache.org/download.html
[2] https://issues.apache.org/jira/browse/SHIRO-460
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists