https://bugzilla.redhat.com/show_bug.cgi?id=1923838
--- Comment #3 from Ted (Jong Seok) Won <jwon(a)redhat.com> ---
Marking Red Hat Fuse 7 as having a low impact, Fuse 7 distributes some shiro
artifacts (shiro-core) as part of camel-shiro however these artifacts are not
impacted by the vulnerability.
Marking Red Hat JBoss Fuse 6 as having a moderate impact, Fuse 6 does
distribute some shiro artifacts as part of camel-shiro, however these are not
affected by the vulnerability, only components using shiro in the context of
the web application portion of the shiro framework are affected and only the
artifacts org.apache.shiro:shiro-web:*, org.apache.shiro:shiro-spring:*,
org.apache.shiro:shiro-guice:* and org.apache.shiro:shiro-all:* are altered in
the fix version of shiro (1.6.0)
Red Hat JBoss AMQ-6 does however distribute shiro-spring in error as part of
the activemq shiro plugin, the artifact would not be used under normal
circumstances and the issue has been marked as moderate because of this,
however as a precaution we have requested the superfluous shiro-spring artifact
be removed from any deliverables.
This vulnerability is out of security support scope for the following
products:
* Red Hat JBoss Fuse 6
Please refer to
https://access.redhat.com/support/policy/updates/jboss_notes
for more details.
--
You are receiving this mail because:
You are on the CC list for the bug.