Advisoriesby IbisApache SolrGHSA-998j-j6v9-5846
Apache Solr UpdateRequestHandler for XML resolves XML External Entities
Fix: upgrade to 4.1.0 or later
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.solr:solr-core Maven | < 4.1.0 | 4.1.0 |
Details and references
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-611
- Also known as
- CVE-2013-6407
- nvd.nist.gov/vuln/detail/CVE-2013-6407
- github.com/apache/lucene-solr/commit/f230486ce6707762c1a6e81655d0fac52887906d
- github.com/apache/lucene-solr
- issues.apache.org/jira/browse/SOLR-3895
- rhn.redhat.com/errata/RHSA-2013-1844.html
- rhn.redhat.com/errata/RHSA-2014-0029.html
- secunia.com/advisories/55542
- secunia.com/advisories/59372
- svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/CHANGES.txt?view=markup
- www.openwall.com/lists/oss-security/2013/11/29/2
More Apache Solr advisories
All Apache Solr
Improper Restriction of XML External Entity Reference in Apache SolrCVE-2012-6612fixed in 4.1.0XML Injection in Apache SolrCVE-2013-6408fixed in 4.3.1Improper Limitation of a Pathname to a Restricted Directory in Apache SolrCVE-2013-6397fixed in 4.6.0Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8795fixed in 5.1.0Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8797fixed in 5.3.1Apache Solr insecure inter-node communicationCVE-2017-7660fixed in 5.5.5 +1