This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro-site.git
commit 61f52252ae1cd80a5e7e998de5173ea90b7a4f5b Author: lprimak <[email protected]> AuthorDate: Sat May 23 21:44:47 2026 -0500 enh: update Apache Shiro vulnerability reports for CVE-2026-48589, CVE-2026-44598, CVE-2026-43827, and CVE-2026-43828 --- src/site/content/security-reports.adoc | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/src/site/content/security-reports.adoc b/src/site/content/security-reports.adoc index fc63d8001..d6070ae08 100644 --- a/src/site/content/security-reports.adoc +++ b/src/site/content/security-reports.adoc @@ -30,31 +30,42 @@ A https://www.apache.org/security/committers.html[more detailed description of t == Apache Shiro Vulnerability Reports +=== link:https://www.cve.org/CVERecord?id=CVE-2026-48589[CVE-2026-48589] +Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. +This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. + +**Mitigation:** +Upgrade to version 2.2.1, or 3.0.0-alpha-2 or later, which fixes the issue by validating the Referer header and restricting redirects only to relative paths within the current application context. + +**Credit:** +Apache Shiro would like to thank *Bartlomiej Dmitruk* for reporting this issue. + === link:https://www.cve.org/CVERecord?id=CVE-2026-44598[CVE-2026-44598] -With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. +With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send an HTTP GET request from the server itself to an arbitrary URL from the cookie. +This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. **Mitigation:** -Upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. +Upgrade to version 2.2.0, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. **Credit:** Apache Shiro would like to thank *James Love* for reporting this issue. === link:https://www.cve.org/CVERecord?id=CVE-2026-43827[CVE-2026-43827] -Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID. +Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID. **Mitigation:** -Upgrade to version 2.1.1, 3.0.0-alpha-2 or later, which fixes the issue. +Upgrade to version 2.2.0, 3.0.0-alpha-2 or later, which fixes the issue by invalidating the existing session and creating a new session with a new ID upon successful login. **Credit:** Apache Shiro would like to thank *Rasmus Moorats* for reporting this issue. === link:https://www.cve.org/CVERecord?id=CVE-2026-43828[CVE-2026-43828] -Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. + +Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without `secure` attribute by default. **Mitigation:** -Upgrade to version 2.1.1, 3.0.0-alpha-2 or later, which fixes the issue. +Upgrade to version 2.2.0, 3.0.0-alpha-2 or later, which fixes the issue by setting the `secure` attribute. **Credit:** Apache Shiro would like to thank *Meteor_Kai* for reporting this issue. @@ -64,7 +75,7 @@ Apache Shiro would like to thank *Meteor_Kai* for reporting this issue. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. -The issue only effects static files. +The issue only affects static files. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: `filterChainResolver.caseInsensitive = true`
