AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SolrGHSA-xhcq-fv7x-grr2

Critical severity vulnerability that affects org.apache.solr:solr-core

Apache Solr

CVE-2019-0192 · Published Mar 14, 2019 · updated Feb 17, 2024

Critical9.8
Fix: upgrade to 7.0.0 or later
GitHub advisory

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

Affected versions

PackageAffectedFixed in
org.apache.solr:solr-core
Maven
>= 5.0.0, < 7.0.07.0.0
>= 6.0.0, < 7.0.07.0.0
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
CVE-2019-0192

More Apache Solr advisories

All Apache Solr
High 7.2Aug 1, 2019XML External Entity (XXE) Injection in Apache SolrCVE-2019-0193fixed in 8.2.0High 7.5Mar 14, 2019Server-Side Request Forgery (SSRF) in org.apache.solr:solr-coreCVE-2017-3164fixed in 7.7.0High 7.5Oct 18, 2018Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-coreCVE-2017-3163fixed in 5.5.4 +1Critical 9.8Oct 17, 2018Remote code execution occurs in Apache SolrCVE-2017-12629fixed in 5.5.5 +2Medium 5.5Oct 17, 2018There is a XML external entity expansion (XXE) vulnerability in Apache Solr config filesCVE-2018-8010fixed in 6.6.4 +1High 7.5Oct 17, 2018There is a XML external entity expansion (XXE) vulnerability in Apache SolrCVE-2018-1308fixed in 6.6.3 +1