https://bugzilla.redhat.com/show_bug.cgi?id=1774726
Bug ID: 1774726
Summary: CVE-2019-12422 shiro: Cookie padding oracle
vulnerability with default configuration
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, ataylor(a)redhat.com,
chazlett(a)redhat.com, dbecker(a)redhat.com,
drieden(a)redhat.com, extras-orphan(a)fedoraproject.org,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gvarsami(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jschluet(a)redhat.com,
kbasil(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
nwallace(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, slinaber(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com
Target Milestone: ---
Classification: Other
Apache Shiro before 1.4.2, when using the default "remember me" configuration,
cookies could be susceptible to a padding attack.
https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790...
--
You are receiving this mail because:
You are on the CC list for the bug.