Patchwire CVEs, their patch status, and feeds to follow them

CVE-2020-11989

Fixed in a distro release EPSS 24%

Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Published 2020-06-22 · CVE record · OSV

Products: Apache Software Foundation Apache Shiro

Fixed upstream

EcosystemPackageFixed in
Mavenorg.apache.shiro:shiro-core1.5.3

Distro releases

ReleasePackageFixed in
Debian 12shiro1.3.2-5
Debian 13shiro1.3.2-5
Debian 14shiro1.3.2-5
Debian 9shiro1.3.2-1+deb9u1
Ubuntu 18.04 LTSshiro1.3.2-3~18.04.1
Ubuntu 20.04 LTSshiro1.3.2-4ubuntu0.1
Ubuntu Pro 16.04 LTSshirono fix