CVE-2016-4437

NameCVE-2016-4437
DescriptionApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs826653

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
shiro (PTS)bullseye1.3.2-4+deb11u1fixed
sid, trixie, bookworm1.3.2-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
shirosource(unstable)1.2.5-1826653

Notes

[jessie] - shiro <no-dsa> (Minor issue)
Search for package or bug name: Reporting problems