Package
opensearch-2-identity-shiro
Component
shiro-core
Latest update
2.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
opensearch-2 bundles org.apache.shiro:shiro-core 1.13.0 via the OpenSearch identity-shiro plugin, which pins this version in its Gradle build. The fix is only available in Apache Shiro 2.x (2.1.0/2.2.0/2.2.1), a major release with breaking API changes (jakarta namespace migration). A forced upgrade to Shiro 2.2.1 in the OpenSearch 2.19.6 identity-shiro plugin fails to compile against the 2.x API surface (verified: stereo PR #146306 build failure, then reverted). Remediation is pending an upstream OpenSearch 2.x release that upgrades or removes the bundled Shiro dependency; upstream removed identity-shiro entirely in OpenSearch 3.x. Exposure note: the vulnerable jar ships only in the standalone opensearch-2-identity-shiro APK; it is not installed in the default opensearch:2.19 image. Refs: NVD + Apache Shiro security advisory.
Status