| //// |
| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| //// |
| |
| = 1.12.0 available with fix CVE-2023-34478 |
| :jbake-author: Francois Papon |
| :jbake-date: 2023-07-18 00:00:00 |
| :jbake-type: post |
| :jbake-status: published |
| :jbake-tags: blog, release |
| :idprefix: |
| :icons: font |
| |
| The Apache Shiro team is pleased to announce the release of Apache Shiro version 1.12.0. |
| This is a feature release for 1.x. |
| |
| This release solves 2 issues since the 1.12.0 release and is available for download now. |
| |
| == All changes |
| |
| You can learn more on link:https://issues.apache.org/jira/projects/SHIRO/versions/12353403[Jira, Release 1.12.0]. |
| |
| === link:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34478[CVE-2023-34478] |
| |
| Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. |
| |
| **Mitigation:** Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+. |
| |
| **Credit:** |
| Apache Shiro would like to thank *swifty tk* for reporting this issue. |
| |
| === Improvement |
| * [https://issues.apache.org/jira/browse/SHIRO-816[SHIRO-816]] - Update shiro-hazelcast to support Hazelcast 5.x |
| |
| === Task |
| * [https://issues.apache.org/jira/browse/SHIRO-849[SHIRO-849]] - Add support for JCache |
| |
| == Download |
| |
| Download and verification instructions are available link:/download.html[on our download page]. |
| |
| == Documentation |
| |
| For more information on link:/documentation.html[Shiro, please read the documentation.] |
| |
| Enjoy! |
| |
| The Apache Shiro Team |
