Bug#1029039: shiro: CVE-2023-22602

[Moritz Mühlenhoff]

Source: shiro
X-Debbugs-CC: team at security.debian.org
Severity: normal
Tags: security

Hi,

The following vulnerability was published for shiro.

CVE-2023-22602[0]:
| When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+,
| a specially crafted HTTP request may cause an authentication bypass.
| The authentication bypass occurs when Shiro and Spring Boot are using
| different pattern-matching techniques. Both Shiro and Spring Boot <
| 2.6 default to Ant style pattern matching. Mitigation: Update to
| Apache Shiro 1.11.0, or set the following Spring Boot configuration
| value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl

Given that we don't include Spring Boot in Debian, this has little
impact. I doubt mixing Shiro as packaged in Debian with an externally
deployed Spring Boot is any realistic scenario...

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-22602
    https://www.cve.org/CVERecord?id=CVE-2023-22602

Please adjust the affected versions in the BTS as needed.