mailing list archives
[Announce] Apache Shiro 1.2.3 Released - Security Advisory
From: Brian Demers <brian.demers () gmail com>
Date: Mon, 3 Mar 2014 10:14:52 -0500
Dear Apache Shiro Community,
The Apache Shiro team has released Apache Shiro version 1.2.3. This is the
third bug fix point release after 1.2.0.
All binaries (.jars) are available in Maven Central already.
This release includes 1 critical vulnerability and is available for
Download  now.
SHIRO-460 - LDAP authentication succeeds even if the user name and
password is not passed.  [CVE-2014-0074]
1.0.0-incubating - 1.2.2
When using an LDAP server that allows unauthenticated bind, Shiro will
authenticate users with an empty password.
NOTE: this is NOT the default for OpenLDAP
Users should upgrade to 1.2.3
Disable unauthenticated binds on your LDAP server (best practice).
The Apache Shiro Team
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- [Announce] Apache Shiro 1.2.3 Released - Security Advisory Brian Demers (Mar 04)