Advisoriesby IbisApache SolrGHSA-6cpj-3g83-q2j4
Improper Restriction of XML External Entity Reference in Apache Solr
Fix: upgrade to 4.1.0 or later
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.solr:solr-core Maven | < 4.1.0 | 4.1.0 |
Details and references
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-611
- Also known as
- CVE-2012-6612
- nvd.nist.gov/vuln/detail/CVE-2012-6612
- github.com/apache/lucene-solr/commit/0d21b900975b7048d2e925d852aeacb9bdc6766c
- github.com/apache/lucene-solr/commit/f230486ce6707762c1a6e81655d0fac52887906d
- github.com/apache/lucene-solr
- issues.apache.org/jira/browse/SOLR-3895
- rhn.redhat.com/errata/RHSA-2013-1844.html
- rhn.redhat.com/errata/RHSA-2014-0029.html
- svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup
More Apache Solr advisories
All Apache Solr
XML Injection in Apache SolrCVE-2013-6408fixed in 4.3.1Apache Solr UpdateRequestHandler for XML resolves XML External EntitiesCVE-2013-6407fixed in 4.1.0Improper Limitation of a Pathname to a Restricted Directory in Apache SolrCVE-2013-6397fixed in 4.6.0Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8795fixed in 5.1.0Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8797fixed in 5.3.1Apache Solr insecure inter-node communicationCVE-2017-7660fixed in 5.5.5 +1