mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-22 08:58:47 +00:00
Code Issues Releases Activity

Document solr issue

Browse Source
This commit is contained in:
Steve Wills 2017-10-13 16:42:49 +00:00
parent b354928e16
commit 1326b40d57
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=452020
1 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
security/vuxml/vuln.xml
View File

@ -58,6 +58,35 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="e837390d-0ceb-46b8-9b32-29c1195f5dc7">
<topic>solr -- Code execution via entity expansion</topic>
<affects>
<package>
<name>apache-solr</name>
<range><ge>5.1</ge><le>6.6.1</le></range>
<range><ge>7.0.0</ge><le>7.0.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Solr developers report:</p>
<blockquote cite="http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html">
<p>Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.</p>
<p>Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html</url>
<url>https://marc.info/?l=apache-announce&amp;m=150786685013286</url>
<cvename>CVE-2017-12629</cvename>
</references>
<dates>
<discovery>2017-10-13</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="6dc3c61c-e866-4c27-93f7-ae50908594fd">
<topic>jenkins -- multiple issues</topic>
<affects>