{"containers": {"cna": {"affected": [{"product": "Apache Solr before 7.1 with Apache Lucene before 7.1", "vendor": "n/a", "versions": [{"status": "affected", "version": "Apache Solr before 7.1 with Apache Lucene before 7.1"}, {"status": "unaffected", "version": "lucene-solr 7.2.0"}, {"status": "unaffected", "version": "lucene-solr 8.0.0"}, {"changes": [{"at": "6.6.2", "status": "unaffected"}, {"at": "5.5.5", "status": "unaffected"}], "lessThan": "7.1.0", "status": "affected", "version": "lucene-solr", "versionType": "custom"}]}, {"platforms": ["redhat"], "product": "Apache Solr before 7.1 with Apache Lucene before 7.1", "vendor": "n/a", "versions": [{"lessThan": "5.3.1-redhat-2", "status": "affected", "version": "lucene-solr", "versionType": "custom"}]}], "datePublic": "2017-10-14T00:00:00", "descriptions": [{"lang": "en", "value": "Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr."}], "problemTypes": [{"descriptions": [{"description": "Remote code execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-08-17T12:06:16", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"name": "RHSA-2017:3451", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:3451"}, {"name": "[lucene-dev] 20171012 Re: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://s.apache.org/FJDl"}, {"name": "RHSA-2018:0002", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0002"}, {"name": "101261", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/101261"}, {"name": "RHSA-2018:0004", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0004"}, {"name": "RHSA-2017:3452", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:3452"}, {"name": "[debian-lts-announce] 20180121 [SECURITY] [DLA 1254-1] lucene-solr security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html"}, {"name": "43009", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/43009/"}, {"name": "RHSA-2018:0003", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0003"}, {"name": "RHSA-2017:3123", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:3123"}, {"name": "RHSA-2018:0005", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0005"}, {"name": "RHSA-2017:3244", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:3244"}, {"name": "RHSA-2017:3124", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:3124"}, {"name": "[www-announce] 20171019 [SECURITY] CVE-2017-12629: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E"}, {"name": "DSA-4124", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2018/dsa-4124"}, {"name": "USN-4259-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4259-1/"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/ApacheSolr/status/918731485611401216"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/searchtools_avi/status/918904813613543424"}, {"tags": ["x_refsource_MISC"], "url": "http://openwall.com/lists/oss-security/2017/10/13/1"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/joshbressers/status/919258716297420802"}, {"name": "[solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E"}, {"name": "[solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E"}, {"name": "[solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E"}, {"name": "[jackrabbit-oak-issues] 20210817 [jira] [Created] (OAK-9537) Security vulnerability in org/apache/lucene/queryparser/xml/CoreParser.java", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2017-12629", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Solr before 7.1 with Apache Lucene before 7.1", "version": {"version_data": [{"version_value": "Apache Solr before 7.1 with Apache Lucene before 7.1"}, {"version_affected": "<", "version_name": "lucene-solr", "version_value": "7.1.0"}, {"version_affected": "<", "version_name": "lucene-solr", "version_value": "6.6.2"}, {"version_affected": "<", "version_name": "lucene-solr", "version_value": "5.5.5"}, {"version_affected": "!", "version_name": "lucene-solr", "version_value": "7.2.0"}, {"version_affected": "!", "version_name": "lucene-solr", "version_value": "8.0.0"}, {"platform": "redhat", "version_affected": "<", "version_name": "lucene-solr", "version_value": "5.3.1-redhat-2"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote code execution"}]}]}, "references": {"reference_data": [{"name": "RHSA-2017:3451", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:3451"}, {"name": "[lucene-dev] 20171012 Re: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)", "refsource": "MLIST", "url": "https://s.apache.org/FJDl"}, {"name": "RHSA-2018:0002", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0002"}, {"name": "101261", "refsource": "BID", "url": "http://www.securityfocus.com/bid/101261"}, {"name": "RHSA-2018:0004", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0004"}, {"name": "RHSA-2017:3452", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:3452"}, {"name": "[debian-lts-announce] 20180121 [SECURITY] [DLA 1254-1] lucene-solr security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html"}, {"name": "43009", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/43009/"}, {"name": "RHSA-2018:0003", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0003"}, {"name": "RHSA-2017:3123", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:3123"}, {"name": "RHSA-2018:0005", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0005"}, {"name": "RHSA-2017:3244", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:3244"}, {"name": "RHSA-2017:3124", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:3124"}, {"name": "[www-announce] 20171019 [SECURITY] CVE-2017-12629: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)", "refsource": "MLIST", "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E"}, {"name": "DSA-4124", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4124"}, {"name": "USN-4259-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4259-1/"}, {"name": "https://twitter.com/ApacheSolr/status/918731485611401216", "refsource": "MISC", "url": "https://twitter.com/ApacheSolr/status/918731485611401216"}, {"name": "https://twitter.com/searchtools_avi/status/918904813613543424", "refsource": "MISC", "url": "https://twitter.com/searchtools_avi/status/918904813613543424"}, {"name": "http://openwall.com/lists/oss-security/2017/10/13/1", "refsource": "MISC", "url": "http://openwall.com/lists/oss-security/2017/10/13/1"}, {"name": "https://twitter.com/joshbressers/status/919258716297420802", "refsource": "MISC", "url": "https://twitter.com/joshbressers/status/919258716297420802"}, {"name": "[solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef@%3Cusers.solr.apache.org%3E"}, {"name": "[solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc@%3Cusers.solr.apache.org%3E"}, {"name": "[solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314@%3Cusers.solr.apache.org%3E"}, {"name": "[jackrabbit-oak-issues] 20210817 [jira] [Created] (OAK-9537) Security vulnerability in org/apache/lucene/queryparser/xml/CoreParser.java", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f@%3Coak-issues.jackrabbit.apache.org%3E"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:43:56.440Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2017:3451", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:3451"}, {"name": "[lucene-dev] 20171012 Re: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://s.apache.org/FJDl"}, {"name": "RHSA-2018:0002", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0002"}, {"name": "101261", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/101261"}, {"name": "RHSA-2018:0004", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0004"}, {"name": "RHSA-2017:3452", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:3452"}, {"name": "[debian-lts-announce] 20180121 [SECURITY] [DLA 1254-1] lucene-solr security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html"}, {"name": "43009", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/43009/"}, {"name": "RHSA-2018:0003", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0003"}, {"name": "RHSA-2017:3123", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:3123"}, {"name": "RHSA-2018:0005", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0005"}, {"name": "RHSA-2017:3244", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:3244"}, {"name": "RHSA-2017:3124", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:3124"}, {"name": "[www-announce] 20171019 [SECURITY] CVE-2017-12629: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E"}, {"name": "DSA-4124", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2018/dsa-4124"}, {"name": "USN-4259-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4259-1/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/ApacheSolr/status/918731485611401216"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/searchtools_avi/status/918904813613543424"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2017/10/13/1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/joshbressers/status/919258716297420802"}, {"name": "[solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E"}, {"name": "[solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E"}, {"name": "[solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E"}, {"name": "[jackrabbit-oak-issues] 20210817 [jira] [Created] (OAK-9537) Security vulnerability in org/apache/lucene/queryparser/xml/CoreParser.java", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2017-12629", "datePublished": "2017-10-14T21:00:00", "dateReserved": "2017-08-07T00:00:00", "dateUpdated": "2024-08-05T18:43:56.440Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D6F404C-2EE9-4A14-9293-AB2DEB3D3BF6", "versionEndIncluding": "5.5.4", "versionStartIncluding": "5.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8614312-907C-4617-82BC-256A8CB85CA1", "versionEndIncluding": "6.6.1", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*", "matchCriteriaId": "729484B3-0906-4B46-8649-51405630D270", "versionEndIncluding": "7.0.1", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "72A54BDA-311C-413B-8E4D-388AD65A170A", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "868C0845-F25C-487F-A697-72917BE9D78E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0", "vulnerable": false}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr."}, {"lang": "es", "value": "Ocurre una ejecuci\u00f3n remota de c\u00f3digo en Apache Solr en versiones anteriores a la 7.1 con Apache Lucene en versiones anteriores a la 7.1 explotando XXE junto con el uso de un comando add-listener de la API de configuraci\u00f3n para alcanzar la clase RunExecutableListener. Elasticsearch, a pesar de que emplea Lucene, NO es vulnerable a esto. Es destacable que la vulnerabilidad de XML external entity expansion ocurre en el analizador sint\u00e1ctico de consulta de XML que est\u00e1 disponible, por defecto, para cualquier petici\u00f3n de consulta con par\u00e1metros deftype=xmlparser y puede ser explotado para subir datos maliciosos al manipulador de peticiones /upload o como XXE ciego empleando un contenedor ftp para leer archivos locales arbitrarios del servidor Solr. Tambi\u00e9n hay que tener en cuenta el hecho de que la segunda vulnerabilidad est\u00e1 relacionada con la ejecuci\u00f3n remota de c\u00f3digo empleando la clase RunExecutableListener disponible en todas las versiones afectadas de Solr."}], "id": "CVE-2017-12629", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-14T23:29:00.260", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E"}, {"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/10/13/1"}, {"source": "security@apache.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/101261"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3123"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3124"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3244"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3451"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3452"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0002"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0003"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0004"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0005"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E"}, {"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html"}, {"source": "security@apache.org", "tags": ["Exploit", "Mailing List", "Vendor Advisory"], "url": "https://s.apache.org/FJDl"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://twitter.com/ApacheSolr/status/918731485611401216"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://twitter.com/joshbressers/status/919258716297420802"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://twitter.com/searchtools_avi/status/918904813613543424"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/4259-1/"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2018/dsa-4124"}, {"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/43009/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/10/13/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/101261"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3123"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3124"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3244"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3451"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:3452"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0002"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0003"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0004"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0005"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Vendor Advisory"], "url": "https://s.apache.org/FJDl"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://twitter.com/ApacheSolr/status/918731485611401216"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://twitter.com/joshbressers/status/919258716297420802"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://twitter.com/searchtools_avi/status/918904813613543424"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/4259-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2018/dsa-4124"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/43009/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2017:3244", "cpe": "cpe:/a:redhat:jboss_data_grid:7.1", "product_name": "Red Hat JBoss Data Grid 7.1", "release_date": "2017-11-16T00:00:00Z"}, {"advisory": "RHSA-2018:0003", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "impact": "moderate", "package": "lucene-core", "product_name": "Red Hat JBoss EAP 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2017:3123", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-lucene-solr-0:5.3.1-4.redhat_2.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2017-11-06T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-activemq-artemis-0:1.1.0-19.SP24_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-hibernate-0:5.0.16-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-ironjacamar-0:1.3.8-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jboss-remoting-0:4.0.25-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jboss-xnio-base-0:3.4.7-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jgroups-0:3.6.12-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-resteasy-0:3.0.19-7.SP5_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-undertow-0:1.3.31-3.Final_redhat_3.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-wildfly-0:7.0.9-4.GA_redhat_3.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0002", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-wildfly-javadocs-0:7.0.9-2.GA_redhat_3.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0005", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jboss-ec2-eap-0:7.0.9-2.GA_redhat_2.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2017:3123", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-lucene-solr-0:5.3.1-4.redhat_2.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2017-11-06T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-activemq-artemis-0:1.1.0-19.SP24_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-hibernate-0:5.0.16-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-ironjacamar-0:1.3.8-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-jboss-remoting-0:4.0.25-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-jboss-xnio-base-0:3.4.7-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-jgroups-0:3.6.12-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-resteasy-0:3.0.19-7.SP5_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-undertow-0:1.3.31-3.Final_redhat_3.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-wildfly-0:7.0.9-4.GA_redhat_3.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0004", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-wildfly-javadocs-0:7.0.9-2.GA_redhat_3.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2018:0005", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7", "impact": "moderate", "package": "eap7-jboss-ec2-eap-0:7.0.9-2.GA_redhat_2.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7", "release_date": "2018-01-03T00:00:00Z"}, {"advisory": "RHSA-2017:3124", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.0 security update", "release_date": "2017-11-06T00:00:00Z"}, {"advisory": "RHSA-2020:2561", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_cd:12", "impact": "moderate", "package": "lucene", "product_name": "Red Hat JBoss Enterprise Application Platform Continuous Delivery", "release_date": "2020-06-15T00:00:00Z"}, {"advisory": "RHSA-2017:3451", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6", "impact": "moderate", "package": "rh-java-common-lucene-0:4.8.0-6.9.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3452", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6", "impact": "moderate", "package": "rh-java-common-lucene5-0:5.4.1-2.4.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3451", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6", "impact": "moderate", "package": "rh-java-common-lucene-0:4.8.0-6.9.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3452", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6", "impact": "moderate", "package": "rh-java-common-lucene5-0:5.4.1-2.4.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3451", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "impact": "moderate", "package": "rh-java-common-lucene-0:4.8.0-6.9.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3452", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "impact": "moderate", "package": "rh-java-common-lucene5-0:5.4.1-2.4.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3451", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "impact": "moderate", "package": "rh-java-common-lucene-0:4.8.0-6.9.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3452", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "impact": "moderate", "package": "rh-java-common-lucene5-0:5.4.1-2.4.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3451", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "impact": "moderate", "package": "rh-java-common-lucene-0:4.8.0-6.9.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2017:3452", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "impact": "moderate", "package": "rh-java-common-lucene5-0:5.4.1-2.4.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS", "release_date": "2017-12-12T00:00:00Z"}, {"advisory": "RHSA-2023:1334", "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13", "impact": "moderate", "package": "lucene", "product_name": "RHPAM 7.13.1 async", "release_date": "2023-03-20T00:00:00Z"}], "bugzilla": {"description": "Solr: Code execution via entity expansion", "id": "1501529", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1501529"}, "csaw": true, "cvss": {"cvss_base_score": "10.0", "cvss_scoring_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "status": "verified"}, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-138", "details": ["Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.", "It was found that Apache Lucene would accept an object from an unauthenticated user that could be manipulated through subsequent post requests. An attacker could use this flaw to assemble an object that could permit execution of arbitrary code if the server enabled Apache Solr's Config API."], "mitigation": {"lang": "en:us", "value": "Until fixes are available, all Solr users are advised to restart their Solr instances with the system parameter `-Ddisable.configEdit=true`. This will disallow any changes to be made to configurations via the Config API. This is a key factor in this vulnerability, since it allows GET requests to add the RunExecutableListener to the config.\nThis is sufficient to protect from this type of attack, but means you cannot use the edit capabilities of the Config API until further fixes are in place."}, "name": "CVE-2017-12629", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform", "fix_state": "Not affected", "package_name": "lucene", "product_name": "Red Hat BPM Suite 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "lucene", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Will not fix", "impact": "moderate", "package_name": "lucene", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "solr", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:6", "fix_state": "Not affected", "package_name": "lucene", "product_name": "Red Hat JBoss BRMS 6"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Affected", "impact": "moderate", "package_name": "lucene", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Not affected", "package_name": "lucene", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Not affected", "package_name": "solr", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Not affected", "package_name": "Camel", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6", "fix_state": "Not affected", "impact": "moderate", "package_name": "solr", "product_name": "Red Hat JBoss Portal 6"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Not affected", "package_name": "openshift3/ose-logging-elasticsearch5", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-logging-elasticsearch5", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-logging-elasticsearch6", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-metering-presto", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "impact": "moderate", "package_name": "lucene", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/o:redhat:rhev_hypervisor:4", "fix_state": "Not affected", "impact": "moderate", "package_name": "lucene", "product_name": "Red Hat Virtualization 4"}], "public_date": "2017-10-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-12629\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-12629\nhttps://access.redhat.com/security/vulnerabilities/CVE-2017-12629"], "statement": "The following products are not affected by this flaw, as they do not use the vulnerable functionality of either aspect of the issue.\nRed Hat JBoss Enterprise Application Platform 6\nRed Hat JBoss BPM Suite\nRed Hat JBoss BRMS\nRed Hat Enterprise Virtualization Manager\nRed Hat Single Sign-On 7\nRed Hat JBoss Portal Platform 6\nRed Hat JBoss Enterprise Application Platform 7 is not affected by this flaw. However, it does ship the vulnerable Lucene class in a dependency to another component. Customers who reuse the lucene-queryparser jar in their applications may be vulnerable to the External Entity Expansion aspect of this flaw. This will be patched in a forthcoming release.\nRed Hat JBoss Fuse is not affected by this flaw, as it does not use the vulnerable functionality of either aspect of this flaw. Fuse customers who may be running external Solr servers, while not affected from the Fuse side, are advised to secure their Solr servers as recommended in the mitigation provided.\nThe following products ship only the Lucene components relevant to this flaw, and are not vulnerable to the second portion of the vulnerability, the code execution exploit. As such, the impact of this flaw has been determined to be Moderate for these respective products:\nRed Hat JBoss Data Grid 7 \nRed Hat Enterprise Linux 6\nRed Hat Software Collections 2.4\nThis issue did not affect the versions of lucene as shipped with Red Hat Enterprise Linux 5.\nThis issue does not affect Elasticsearch as shipped in OpenShift Container Platform.", "threat_severity": "Critical"}

{}