AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SolrGHSA-jq2w-w7v2-69q5

Apache Solr vulnerable to XML Bomb

Apache Solr

CVE-2019-12401 · Published May 24, 2022 · updated Feb 21, 2024

High7.5
Fix: upgrade to 5.0.0 or later
GitHub advisory

Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it?s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.

Affected versions

PackageAffectedFixed in
org.apache.solr:solr-core
Maven
< 5.0.05.0.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-776
Also known as
CVE-2019-12401

More Apache Solr advisories

All Apache Solr
HighMay 17, 2022Improper Restriction of XML External Entity Reference in Apache SolrCVE-2012-6612fixed in 4.1.0MediumMay 17, 2022XML Injection in Apache SolrCVE-2013-6408fixed in 4.3.1MediumMay 17, 2022Apache Solr UpdateRequestHandler for XML resolves XML External EntitiesCVE-2013-6407fixed in 4.1.0MediumMay 17, 2022Improper Limitation of a Pathname to a Restricted Directory in Apache SolrCVE-2013-6397fixed in 4.6.0Medium 6.1May 17, 2022Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8795fixed in 5.1.0Medium 6.1May 17, 2022Improper Neutralization of Input During Web Page Generation in Apache SolrCVE-2015-8797fixed in 5.3.1