https://bugzilla.redhat.com/show_bug.cgi?id=1375884
Bug ID: 1375884
Summary: CVE-2016-6802 Apache Shiro: Security servlet filters
bypass
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
chazlett(a)redhat.com, dmcphers(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
jokerman(a)redhat.com, kconner(a)redhat.com,
kseifried(a)redhat.com, ldimaggi(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
puntogil(a)libero.it, rwagner(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
tcunning(a)redhat.com, tiwillia(a)redhat.com,
tkirby(a)redhat.com
Apache Shiro before 1.3.2, when using a non-root servlet context path,
specifically crafted requests can be used to by pass some security servlet
filters, resulting in unauthorized access.
References:
http://seclists.org/oss-sec/2016/q3/488
--
You are receiving this mail because:
You are on the CC list for the bug.