Fork me on GitHub

Apache Shiro Logo Simple. Java. Security. Apache Software Foundation Event Banner

1.10.0 available with fix CVE-2022-40664

Published by  on the

The Shiro team is pleased to announce the release of Apache Shiro version 1.10.0. This is a feature release for 1.x.

This release solves 7 issues since the 1.9.1 release and is available for download now.

All changes

You can learn more on Jira, Release 1.10.0.

CVE-2022-40664

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.

Credit: Apache Shiro would like to thank Y4tacker for reporting this issue.

Bug

  • [SHIRO-512] - Race condition in Shiro’s web container session timeout handling

  • [SHIRO-887] - FormAuthenticationFilter trims passwords which start and/or end with one or more space character(s)

Improvement

  • [SHIRO-891] - fix source jar Reproducible Builds issue

  • [SHIRO-884] - fix source jar Reproducible Builds issue

  • [SHIRO-885] - Use OWASP Java Encoder with OSGi manifest

  • [SHIRO-890] - Avoid another proxy creator when @EnableAspectJAutoProxy enabled

  • [SHIRO-891] - Allow for direct configuration of ShiroFilter through WebEnvironment

Dependency upgrade

  • Many dependency updates

Behavior Changes

As of 1.10.0, Shiro may filter a request multiple times, e.g. when including or forwarding requests.

This behavior can be reverted by setting the following property: shiro.filterOncePerRequest=true

Download

Download and verification instructions are available on our download page.

Documentation

For more information on Shiro, please read the documentation.

Enjoy!

The Apache Shiro Team