Source Package: shiro (1.3.2-5)
Apache Shiro - Java Security Framework
The following binary packages are built from this source package:
- libshiro-java
Apache Shiro - Java Security Framework
Packages / Debian 12 (Bookworm) / Source / java / shiro
Known vulnerabilities
Matching against OpenFactory catalog package versions is in progress.
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-58301] Published: When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and tran | Medium(5.9) | AffectedDetails (2)
|
| [CVE-2026-56091] Published: When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org | High(8.2) | AffectedDetails (2)
|
| [CVE-2026-56130] Published: "Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. | Low(3) | AffectedDetails (2)
|
| [CVE-2026-49268] Published: A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN tem | High(8.8) | AffectedDetails (2)
|
| [CVE-2026-43828] Published: Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommend | Medium(6.5) | AffectedDetails (2)
|
| [CVE-2026-43827] Published: Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, | High(7.1) | AffectedDetails (2)
|
| [CVE-2026-23901] Published: shiro: CVE-2026-23901 | Low(2.9) | AffectedDetails (2)
|
| [CVE-2026-23903] Published: shiro: CVE-2026-23903 | Medium(5.3) | AffectedDetails (2)
|
| [CVE-2022-40664] Published: shiro: CVE-2022-40664 | Critical(9.8) | AffectedDetails (2)
|
| [CVE-2022-32532] Published: shiro: CVE-2022-32532 | High(8.1) | AffectedDetails (2)
|
| [CVE-2021-41303] Published: shiro: CVE-2021-41303 | Medium | AffectedDetails (2)
|
| [CVE-2019-12422] Published: shiro: CVE-2019-12422 | High(7.4) | AffectedDetails (2)
|
Fixed and unaffected versions (8)
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-48589] Published: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could | Medium(4.6) | Not affectedDetails (2)
|
| [CVE-2026-44598] Published: With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha | Medium(5.1) | Not affectedDetails (2)
|
| [CVE-2020-17510] Published: shiro: CVE-2020-17510 | Critical(9.8) | FixedDetails (2)
|
| [CVE-2020-13933] Published: shiro: CVE-2020-13933 | High(7.5) | FixedDetails (2)
|
| [CVE-2020-11989] Published: shiro: CVE-2020-11989 | Critical(9.8) | FixedDetails (2)
|
| [CVE-2020-1957] Published: shiro: CVE-2020-1957 | Medium | FixedDetails (2)
|
| [CVE-2020-17523] Published: shiro: CVE-2020-17523 | Critical(9.8) | Not affectedDetails (2)
|
| [CVE-2016-6802] Published: Apache Shiro vulnerabilities | Medium(5.6) | FixedDetails (2)
|
Last synced:
Sources
- Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Observed SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Result
- match verified
- Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Observed SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Result
- match verified