Apache SolrGHSA-f553-j2gv-g5r9
Apache Solr Kerberos delegation token functionality flaws
High7.5CVE-2017-9803 · Published May 14, 2022 · updated Nov 8, 2023
Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.solr:solr-core Maven | >= 6.2.0, < 6.6.1 | 6.6.1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2017-9803
More Apache Solr advisories
All Apache Solr| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 172022 | Apache Solr UpdateRequestHandler for XML resolves XML External Entities MediumMay 17, 2022 | Medium | 4.1.0 |
| May 172022 | XML Injection in Apache SolrMediumMay 17, 2022 | Medium | 4.3.1 |
| May 172022 | Improper Limitation of a Pathname to a Restricted Directory in Apache SolrMediumMay 17, 2022 | Medium | 4.6.0 |
| May 172022 | Improper Neutralization of Input During Web Page Generation in Apache SolrMedium6.1May 17, 2022 | Medium6.1 | 5.1.0 |
| May 172022 | Improper Neutralization of Input During Web Page Generation in Apache SolrMedium6.1May 17, 2022 | Medium6.1 | 5.3.1 |
| May 142022 | Apache Solr insecure inter-node communicationHigh7.5May 14, 2022 | High7.5 | 5.5.5+1 more |