fix: backport CVE-2026-49268/43827/43828 fixes, bump to 1.13.2-alauda - #3
Merged
Conversation
Backport of upstream apache/shiro@9063406e70 to 1.13.x line. Sanitize user-supplied principal via javax.naming.ldap.Rdn.escapeValue() before concatenating into the LDAP DN template in DefaultLdapRealm and ActiveDirectoryRealm. Prevents remote attackers from injecting RFC 2253 special characters to manipulate the bind DN. Upstream-PR: N/A (private-security fix commit) Cherry-picked-from: 9063406e70b0d7d24bc57cd15b4c40dad5a35c60
Backport of upstream apache/shiro@92eb6fb331 to 1.13.x line. Before creating the logged-in Subject, invalidate any pre-existing session on the authenticating Subject. Prevents session fixation: an attacker who tricks a victim into using an attacker-known session ID can no longer inherit the authenticated context after the victim logs in. Upstream-PR: N/A (private-security fix commit) Cherry-picked-from: 92eb6fb331
Backport of upstream apache/shiro@c95a185e6e to 1.13.x line. - DefaultSessionManager: add SECURE_COOKIE_DISABLED opt-out constant - DefaultWebSessionManager: set Secure=true on session id cookie by default - CookieRememberMeManager: set Secure=true on rememberMe cookie by default - SimpleCookie.saveTo: only emit Secure attribute when request is also secure (defense-in-depth: prevents Secure flag from being sent over an insecure connection where it would be dropped anyway) Operators can restore pre-patch behaviour with -Dorg.apache.shiro.cookie.secure.disabled=true . Upstream-PR: N/A (private-security fix commit) Cherry-picked-from: c95a185e6e
OSGi Bundle-Version derived: 1.13.2.alauda (within [1.13, 2.0) range). API-compatible with 1.13.1-alauda / upstream 1.13.0.
Triggers on v*-alauda tag push. Builds core and web modules with JDK 8, attaches the resulting shiro-core-<version>.jar and shiro-web-<version>.jar to a GitHub Release. Replaces the manual jar-upload flow used for v1.13.1-alauda.
7 tasks
kycheng
added a commit
to kycheng/nexus-build
that referenced
this pull request
Jul 6, 2026
…ases Now that AlaudaDevops/shiro#3 and AlaudaDevops/jline3#2 are merged and their release workflows have published: - shiro-core-1.13.2-alauda.jar - shiro-web-1.13.2-alauda.jar - jline-3.21.0-alauda.jar Wire the new jars into the image build so the following CVEs are actually patched at runtime: - CVE-2026-49268 (HIGH) shiro-core LDAP DN injection - CVE-2026-43827 (MEDIUM) shiro-core session fixation on login - CVE-2026-43828 (MEDIUM) shiro-web insecure session/rememberMe cookies - CVE-2026-56741 (HIGH) jline telnet NAWS DoS - CVE-2026-56740 (HIGH) jline telnet NEW-ENVIRON heap DoS Trivy version-matches by string, so the fork versions still trip its DB rules even with the fix applied. Extended .trivyignore with the five CVE/GHSA IDs (plus the pre-existing CVE-2026-23901) documenting the backport in each case. Local smoke test: Nexus starts cleanly, HTTP 200 on 8081, 10/10 smoke tests pass. Trivy re-scan: 0 findings above the ignore list.
kycheng
added a commit
to AlaudaDevops/nexus-build
that referenced
this pull request
Jul 6, 2026
…ork WIP (#39) * fix(cve): patch 5 CVEs across jackson/postgresql/jetty jars Applied fixes in this pass (rebuild + smoke test verified — Nexus 3.76.0-03 starts cleanly, all 10 smoke tests pass, HTTP 200 on 8081): - CVE-2026-54512 HIGH jackson-databind 2.17.0 -> 2.18.8 - CVE-2026-54513 HIGH jackson-databind 2.17.0 -> 2.18.8 - CVE-2026-54514 MED jackson-databind 2.17.0 -> 2.18.8 - CVE-2026-42198 MED postgresql 42.7.2 -> 42.7.11 To keep the Jackson OSGi wiring intact (databind imports com.fasterxml.jackson.annotation with range [2.18, 3.0)), also bump jackson-core to 2.18.8 and add a jackson-annotations 2.17.0 -> 2.18.8 replacement step. Exemptions added to .trivyignore: - CVE-2026-54515 MED jackson-databind — fix versions 2.18.9 / 2.21.5 are not yet released to Maven Central as of 2026-07-02; only 3.1.4 has the patch and is a major incompatible bump. Remove after 2.18.9 lands. - CVE-2026-23901 LOW shiro-core — already backported in the 1.13.1-alauda fork; Trivy still matches on version string < 2.1.0. Still open, tracked separately (fork PRs pending): - CVE-2026-49268 HIGH shiro-core LDAP — AlaudaDevops/shiro#3 - CVE-2026-43827 MED shiro-core session fixation — AlaudaDevops/shiro#3 - CVE-2026-43828 MED shiro-web secure cookie — AlaudaDevops/shiro#3 - CVE-2026-56740 HIGH jline telnet NEW-ENVIRON — AlaudaDevops/jline3#2 - CVE-2026-56741 HIGH jline telnet NAWS — AlaudaDevops/jline3#2 Once those fork releases publish, bump the TODO(sec) markers in Containerfile and add the corresponding shiro-web / org.jline.jline replace.sh steps. * fix(ci): use archive.apache.org for Maven download in test-base image dlcdn.apache.org rotates old Maven versions off the mirror (3.9.14 was removed after 3.9.16 became latest), which broke build-testing-base-image with curl exit 22 / HTTP 404. archive.apache.org keeps all historical versions permanently. * fix(cve): consume shiro 1.13.2-alauda + jline 3.21.0-alauda fork releases Now that AlaudaDevops/shiro#3 and AlaudaDevops/jline3#2 are merged and their release workflows have published: - shiro-core-1.13.2-alauda.jar - shiro-web-1.13.2-alauda.jar - jline-3.21.0-alauda.jar Wire the new jars into the image build so the following CVEs are actually patched at runtime: - CVE-2026-49268 (HIGH) shiro-core LDAP DN injection - CVE-2026-43827 (MEDIUM) shiro-core session fixation on login - CVE-2026-43828 (MEDIUM) shiro-web insecure session/rememberMe cookies - CVE-2026-56741 (HIGH) jline telnet NAWS DoS - CVE-2026-56740 (HIGH) jline telnet NEW-ENVIRON heap DoS Trivy version-matches by string, so the fork versions still trip its DB rules even with the fix applied. Extended .trivyignore with the five CVE/GHSA IDs (plus the pre-existing CVE-2026-23901) documenting the backport in each case. Local smoke test: Nexus starts cleanly, HTTP 200 on 8081, 10/10 smoke tests pass. Trivy re-scan: 0 findings above the ignore list. * chore(chart): bump nexus image to v3.76.0-ga495c68 Manually built via PipelineRun nexus-image-manual-hqlrf on business-build cluster (PAC webhook relay gosmee was broken so bypassed it and directly created the PipelineRun). Image contains the shiro 1.13.2-alauda + jline 3.21.0-alauda fork jars that clear the remaining 5 CVEs. Digest: sha256:84c9c91edb0e4e9a82c0185ab29c0fadf3fbdbd4a0dcdd02cd16f271de8a245b * chore: ping PAC after gosmee restart
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport three Apache Shiro CVE fixes into the 1.13.x-alauda line and cut a new tag
v1.13.2-alauda.Rdn.escapeValue()inDefaultLdapRealmandActiveDirectoryRealmDefaultSecurityManager)Secure(DefaultSessionManager,DefaultWebSessionManager,CookieRememberMeManager,SimpleCookie), overridable via-Dorg.apache.shiro.cookie.secure.disabled=trueCherry-picked from upstream:
9063406e70— Using Rdn.escapeValues()92eb6fb331— destroy existing session upon loginc95a185e6e— native session management secure cookieCompatibility
1.13.2.alauda(still within[1.13, 2.0)range required by Nexus's Karaf)1.13.1-alauda/ upstream1.13.0Release automation
Adds
.github/workflows/release.yml— on push of av*-alaudatag, buildsshiro-core-<version>.jarandshiro-web-<version>.jarand attaches them to a GitHub Release.Test plan
v1.13.2-alaudaSHIRO_CORE_NEW_VERSION, adds shiro-web replace step, rebuilds image🤖 Generated with Claude Code