CVE-2016-4437

NameCVE-2016-4437
DescriptionApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs826653

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
shiro (PTS)jessie1.2.3-1vulnerable
stretch1.3.2-1fixed
bullseye, sid, buster1.3.2-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
shirosource(unstable)1.2.5-1826653

Notes

[jessie] - shiro <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems