[
https://issues.apache.org/jira/browse/SHIRO-723?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16941852#comment-16941852
]
Francois Papon commented on SHIRO-723:
--------------------------------------
Yes, you can track the progress on the release page:
[https://issues.apache.org/jira/projects/SHIRO/versions/12344991https://issues.apache.org/jira/projects/SHIRO?selectedItem=com.atlassian.jira.jira-projects-plugin%3Arelease-page&status=unreleased|https://issues.apache.org/jira/projects/SHIRO?selectedItem=com.atlassian.jira.jira-projects-plugin%3Arelease-page&status=unreleased]
We will cut the release so some non critical issues will not be keep if we
don't have time to fix them.
> Provide Minor Shiro Release that includes CVE-2019-10086 Fix
> ------------------------------------------------------------
>
> Key: SHIRO-723
> URL: https://issues.apache.org/jira/browse/SHIRO-723
> Project: Shiro
> Issue Type: Request
> Affects Versions: 1.4.1
> Reporter: Mark Denihan
> Priority: Major
> Fix For: 1.5.0
>
>
> As a User of Shiro
> I want Shiro to pass security scans
> So that it doesn't break my pipeline
> The latest version of Shrio includes the risk from CVE-2019-10086. This has
> been fixed in SHIRO-720 and is in master. However there is no release
> available that includes the August Merge Request.
> ref:
> [https://github.com/apache/shiro/pull/167]
> https://issues.apache.org/jira/browse/SHIRO-720
> [https://nvd.nist.gov/vuln/detail/CVE-2019-10086]
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
