=====================================================================

                                 CERT-Renater

                     Note d'Information No. 2022/VULN221

_____________________________________________________________________

DATE                : 29/06/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Shiro versions prior to
                                         1.9.1.

=====================================================================
https://lists.apache.org/thread/h5b8xl6df21vw59psnq7tn01crc7zp26
_____________________________________________________________________

[ANNOUNCE][CVE-2022-32532] Apache Shiro 1.9.1 released
The Shiro team is pleased to announce the release of Apache Shiro
version 1.9.1.

This security release contains 6 fixes since the 1.9.0 release and
is available for Download now [1].

Improvement
     * [SHIRO-871] - ActiveDirectoryRealm - append suffix only if
missing from username
     * [SHIRO-872] - fix Reproducible Builds issues
     * [SHIRO-883] - Add support for case insensitive regex path
matching

Dependency upgrade
     * [SHIRO-878] - Update Spring Dependencies to 5.2.20
     * [SHIRO-882] - Upgrade to apache pom parent 26
     * [SHIRO-881] - pom.xml in samples/web may lack dependency

CVE-2022-32532:

Apache Shiro before 1.9.1, A RegexRequestMatcher can be
misconfigured to be bypassed on some servlet containers.
Applications using RegExPatternMatcher with `.` in the
regular expression are possibly vulnerable to an
authorization bypass.


Credit:
Apache Shiro would like the thank 4ra1n for reporting this
issue.


Release binaries (.jars) are also available through Maven Central
and source bundles through Apache distribution mirrors.

For more information on Shiro, please read the documentation [2].

-The Apache Shiro Team

[1] http://shiro.apache.org/download.html
[2] http://shiro.apache.org/documentation.html



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================