Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2016-4437 →

DEBIAN-CVE-2016-4437

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 shiro

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1"}]}]

Debian:13 shiro

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1"}]}]

Debian:14 shiro

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1"}]}]

Références

advisory security-tracker.debian.org