PT-2019-4283 · Apache+1 · Apache Shiro+1

CVE-2019-12422 · Publicado 2019-11-18 · Atualizado 2023-02-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.4.2

Description The issue is related to the use of the default "remember me" configuration in Apache Shiro, which can make cookies susceptible to a padding attack. This could allow a remote attacker to impact the integrity of cookie files.

Recommendations For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider disabling the default "remember me" configuration until a patch is available. Restrict access to sensitive areas of the application that rely on cookie-based authentication to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-04890

CVE-2019-12422

GHSA-R679-M633-G7WC

Produtos afetados

Apache Shiro

Debian

Referências · 19

• https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E · Nota
• https://packages.debian.org/src:shiro · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12422 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-04890 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-12422 · Aviso do Fabricante
• https://t.me/cvenotify/45164 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12422 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2019-12422 · Nota
• https://osv.dev/vulnerability/CVE-2019-12422 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2019/11/18/1 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12422 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r679-m633-g7wc · Aviso do Fabricante
• https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c%40%3Cdev.shiro.apache.org%3E · Nota
• https://security-tracker.debian.org/tracker/source-package/shiro · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-12422 · Aviso do Fabricante