This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 0e3fea553 fix CVE number
0e3fea553 is described below
commit 0e3fea553bb354b88f0c1c52ae921e2aed21e2cc
Author: lprimak <[email protected]>
AuthorDate: Wed Jun 24 13:38:38 2026 -0500
fix CVE number
---
.well-known/security.txt | 2 +-
feed.xml | 2 +-
security-reports.html | 6 +++---
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/.well-known/security.txt b/.well-known/security.txt
index 61e68fa4f..75c7e6ec0 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-06-24T18:27:56Z
+Expires: 2027-06-24T18:38:22Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/feed.xml b/feed.xml
index a7d04d5ac..69b1703bf 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-06-24T18:27:57Z</updated>
+ <updated>2026-06-24T18:38:22Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/security-reports.html b/security-reports.html
index 6ff8fd540..9566a630f 100644
--- a/security-reports.html
+++ b/security-reports.html
@@ -233,8 +233,8 @@
<li><a href="#apache_shiro_vulnerability_reports">Apache Shiro Vulnerability
Reports</a>
<ul class="sectlevel2">
<li><a href="#cve_2026_56091">CVE-2026-56091</a></li>
+<li><a href="#cve_2026_56130">CVE-2026-56130</a></li>
<li><a href="#cve_2026_49268">CVE-2026-49268</a></li>
-<li><a href="#cve_2026_49268_2">CVE-2026-49268</a></li>
<li><a href="#cve_2026_48589">CVE-2026-48589</a></li>
<li><a href="#cve_2026_44598">CVE-2026-44598</a></li>
<li><a href="#cve_2026_43827">CVE-2026-43827</a></li>
@@ -324,7 +324,7 @@ Apache Shiro would like to thank <strong>LocalHost</strong>
for reporting this i
</div>
</div>
<div class="sect2">
-<h3 id="cve_2026_49268"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-49268";>CVE-2026-49268</a></h3>
+<h3 id="cve_2026_56130"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-56130";>CVE-2026-56130</a></h3>
<div class="paragraph">
<p>"Remember me" cookie age is not verified on the server. This potentially
allows an attacker to intercept a valid cookie and reuse it indefinitely, even
after the configured expiration time has passed.
This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and
3.0.0-alpha-1, only when RememberMe functionality is enabled.</p>
@@ -339,7 +339,7 @@ Apache Shiro would like to thank <strong>Richard
Bradley</strong> for reporting
</div>
</div>
<div class="sect2">
-<h3 id="cve_2026_49268_2"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-49268";>CVE-2026-49268</a></h3>
+<h3 id="cve_2026_49268"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-49268";>CVE-2026-49268</a></h3>
<div class="paragraph">
<p>A remote attacker can inject LDAP special characters into the Distinguished
Name (DN) construction in <code>DefaultLdapRealm</code> class. User-supplied
username input is directly concatenated into the LDAP DN template without any
escaping of RFC 2253 special characters. This allows an attacker to manipulate
the DN structure used for LDAP bind authentication, potentially bypassing
authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1
when using <code>DefaultLdapRealm</code>.</p>
