UnratedFix available
Apache Shiro 3.0.0
Apache Shiro 3.0.0 enables case-insensitive path matching by default for shiro.ini-based configurations and adds NoAccessFilter to the default filter chain. The release notes describe these as security improvements, but do not identify fixed versions for a vulnerability.
Announced Group revision 1
Original source ↗github-apache-shiro
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Security improvements: Case-insensitive path matching is now enabled by default for shiro.ini-based configurations only (hardened by default) Added NoAccessFilter and add it to the default filter chain (breaking change, hardened-by-default)
Apache Shiro
Apache Shiro 3.0.0
- Affected versions
- Not stated in this extraction
- Fixed versions
- 3.0.0
Apache Shiro 3.0.0
- Prerequisites
- shiro.ini-based configurations
Case-insensitive path matching is now enabled by default for shiro.ini-based configurations only
Publisher severity
No explicit severity was extracted.
- Event
- #77403 · Revision 1
- Added to Heist Feed
- Publisher date