{"action":"closed","issue":{"url":"https://api.github.com/repos/apereo/cas/issues/1824","repository_url":"https://api.github.com/repos/apereo/cas","labels_url":"https://api.github.com/repos/apereo/cas/issues/1824/labels{/name}","comments_url":"https://api.github.com/repos/apereo/cas/issues/1824/comments","events_url":"https://api.github.com/repos/apereo/cas/issues/1824/events","html_url":"https://github.com/apereo/cas/issues/1824","id":158708585,"number":1824,"title":"Update Apache Shiro dependency version","user":{"login":"mmoayyed","id":1205228,"avatar_url":"https://avatars.githubusercontent.com/u/1205228?v=3","gravatar_id":"","url":"https://api.github.com/users/mmoayyed","html_url":"https://github.com/mmoayyed","followers_url":"https://api.github.com/users/mmoayyed/followers","following_url":"https://api.github.com/users/mmoayyed/following{/other_user}","gists_url":"https://api.github.com/users/mmoayyed/gists{/gist_id}","starred_url":"https://api.github.com/users/mmoayyed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmoayyed/subscriptions","organizations_url":"https://api.github.com/users/mmoayyed/orgs","repos_url":"https://api.github.com/users/mmoayyed/repos","events_url":"https://api.github.com/users/mmoayyed/events{/privacy}","received_events_url":"https://api.github.com/users/mmoayyed/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/apereo/cas/labels/Security","name":"Security","color":"e11d21"},{"url":"https://api.github.com/repos/apereo/cas/labels/Shiro","name":"Shiro","color":"5319e7"},{"url":"https://api.github.com/repos/apereo/cas/labels/Task","name":"Task","color":"522900"},{"url":"https://api.github.com/repos/apereo/cas/labels/Trivial","name":"Trivial","color":"009800"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/apereo/cas/milestones/34","html_url":"https://github.com/apereo/cas/milestones/4.2.3","labels_url":"https://api.github.com/repos/apereo/cas/milestones/34/labels","id":1779092,"number":34,"title":"4.2.3","description":"Maintenance release","creator":{"login":"mmoayyed","id":1205228,"avatar_url":"https://avatars.githubusercontent.com/u/1205228?v=3","gravatar_id":"","url":"https://api.github.com/users/mmoayyed","html_url":"https://github.com/mmoayyed","followers_url":"https://api.github.com/users/mmoayyed/followers","following_url":"https://api.github.com/users/mmoayyed/following{/other_user}","gists_url":"https://api.github.com/users/mmoayyed/gists{/gist_id}","starred_url":"https://api.github.com/users/mmoayyed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmoayyed/subscriptions","organizations_url":"https://api.github.com/users/mmoayyed/orgs","repos_url":"https://api.github.com/users/mmoayyed/repos","events_url":"https://api.github.com/users/mmoayyed/events{/privacy}","received_events_url":"https://api.github.com/users/mmoayyed/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":4,"state":"open","created_at":"2016-05-20T15:57:49Z","updated_at":"2016-06-06T20:10:51Z","due_on":"2016-06-24T04:00:00Z","closed_at":null},"comments":1,"created_at":"2016-06-06T15:39:31Z","updated_at":"2016-06-06T20:10:51Z","closed_at":"2016-06-06T20:10:51Z","body":"From Shiro:\r\n\r\n```\r\nSeverity: Important\r\n\r\nVendor:\r\nThe Apache Software Foundation\r\n\r\nVersions Affected:\r\n1.0.0-incubating - 1.2.4\r\n\r\nDescription:\r\nA default cipher key is used for the \"remember me\" feature when not explicitly configured.  A request that included a specially crafted request parameter could be used to execute arbitrary code or access content that would otherwise be protected by a security constraint.\r\n\r\nMitigation:\r\nUsers should upgrade to 1.2.5 [1],  ensure a secret cipher key is configured [2], or disable the \"remember me\" feature. [3]\r\n\r\nAll binaries (.jars) are available in Maven Central already.\r\n\r\nReferences:\r\n[1] http://shiro.apache.org/download.html\r\n[2] http://shiro.apache.org/configuration.html#Configuration-ByteArrayValues\r\n[3] If using a shiro.ini, \"remember me\" can be disabled adding the following config line in the '[main]' section:\r\n  securityManager.rememberMeManager = null\r\n```\r\n\r\nWhile CAS is not affected by this issue in any way, we should nonetheless make the upgrade. "}}
{"actor":{"display_login":"mmoayyed"}}