[Bug 1869860] New: CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

Bug ID: 1869860
           Summary: CVE-2020-13933 shiro: specially crafted HTTP request
                    may cause an authentication bypass
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
  Target Milestone: ---
    Classification: Other

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP
request may cause an authentication bypass.

Reference:
https://lists.apache.org/thread.html/r539f87706094e79c5da0826030384373f00410...

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1869861

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1869861
[Bug 1869861] CVE-2020-13933 shiro: specially crafted HTTP request may cause an
authentication bypass [fedora-all]

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #1 from Guilherme de Almeida Suckevicz  ---
Created shiro tracking bugs for this issue:

Affects: fedora-all [bug 1869861]

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1869863

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

Chess Hazlett  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|                            |shiro 1.6.0

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

Chess Hazlett  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |high
           Severity|medium                      |high

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #4 from Chess Hazlett  ---
amq 6.3.0 ships the vulnerable code in its offline repo.

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #6 from Anten Skrabec  ---
Marking RHOSP as follows: 
10 as new/ooss -> technical preview
13 as new/wontfix -> only fixing imp/crit at this time

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #7 from Anten Skrabec  ---
Statement:

Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw
because it was deprecated as of RHOSP14 and is only receiving security fixes
for Important and Critical flaws.

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

Anten Skrabec  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #8 from Anten Skrabec  ---
Setting Red Hat OpenStack Platform to notaffected as we shi[p the vulnerable
code but do not use the feature. OpenDaylight implements its own dynamic filter
chain for use within OpenDaylight.

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Doc Text *updated* by Eric Christensen  ---
A flaw was found in Apache Shiro in versions prior to 1.6.0. A specially crafted HTTP request may cause an authentication bypass. The highest threat from this vulnerability is to data confidentiality.

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #10 from Nick Tait  ---
Statement:

OpenDaylight will not be updated for this flaw because it was deprecated as of
Red Hat OpenStack Platform 14 and is only receiving security fixes for
Important and Critical flaws.

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #11 from Chess Hazlett  ---
Mitigation:

There is currently no known mitigation for this issue.

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #12 from Jonathan Christison  ---
Marking Red Hat JBoss Fuse 6 as having a moderate impact, Fuse 6 does
distribute some shiro artifacts as part of camel-shiro, however these are not
affected by the vulnerability, only components using shiro in the context of
the web application portion of the shiro framework are affected and only the
artifacts org.apache.shiro:shiro-web:*, org.apache.shiro:shiro-spring:*,
org.apache.shiro:shiro-guice:* and org.apache.shiro:shiro-all:* are altered in
the fix version of shiro (1.6.0)

Red Hat JBoss AMQ-6 does however distribute shiro-spring in error as part of
the activemq shiro plugin, the artifact would not be used under normal
circumstances and the issue has been marked as moderate because of this,
however as a precaution we have requested the superfluous shiro-spring artifact
be removed from any deliverables.

This vulnerability is out of security support scope for the following
products:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #13 from Jonathan Christison  ---
Marking Red Hat Fuse 7 as having a low impact, Fuse 7 distributes some shiro
artifacts (shiro-core) as part of camel-shiro however these artifacts are not
impacted by the vulnerability

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #14 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Fuse 7.8.0

Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2020:5568

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2020-12-16 16:19:18

--- Comment #15 from Product Security DevOps Team  ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-13933

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860

--- Comment #16 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Fuse/AMQ 6.3.18

Via RHSA-2021:0384 https://access.redhat.com/errata/RHSA-2021:0384

[Bug 1869860] CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1869860
Bug 1869860 depends on bug 1869861, which changed state.

Bug 1869861 Summary: CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1869861

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |EOL