[Announce] Apache Shiro 1.2.3 Released - Security Advisory
Brian Demers <[email protected]>
| Newsgroups | gmane.comp.apache.shiro.devel,gmane.comp.jakarta.lucene.net.user,gmane.comp.security.full-disclosure,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CAH9eYVrCp8pGXJiZM2F-9-h2z-hk+gGSk5GkhLs_wf-E_DVQ5Q@mail.gmail.com> |
Dear Apache Shiro Community, The Apache Shiro team has released Apache Shiro version 1.2.3. This is the third bug fix point release after 1.2.0. All binaries (.jars) are available in Maven Central already. This release includes 1 critical vulnerability and is available for Download [1] now. SHIRO-460 - LDAP authentication succeeds even if the user name and password is not passed. [2] [CVE-2014-0074] Versions Affected: 1.0.0-incubating - 1.2.2 Details: When using an LDAP server that allows unauthenticated bind, Shiro will authenticate users with an empty password. NOTE: this is NOT the default for OpenLDAP Mitigation: Users should upgrade to 1.2.3 Workaround: Disable unauthenticated binds on your LDAP server (best practice). Cheers, The Apache Shiro Team [1] http://shiro.apache.org/download.html [2] https://issues.apache.org/jira/browse/SHIRO-460