← Back to the dependency CVE table
Published:
Status: in_triage
Affected Solr versions: ≤ 9.9.0
When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.
Published:
Status: not_affected
Affected Solr versions: 9.4.0–9.8.1
CVE-2024-51504 is not considered exploitable in typical production deployments of Apache Solr. Successful exploitation requires a very specific and non-standard configuration. The following conditions must all be met:
server/solr/zoo.cfg).
By default, this feature is disabled:# Disable ZK AdminServer since we do not use it
admin.enableServer=false
Because these conditions are highly unlikely in secure, production-grade environments, the Solr community considers this vulnerability non-exploitable under standard operating conditions.
Status: not_affected
Affected Solr versions: < 9.8
Solr does not use the Jetty "HttpURI" utility class necessary for the vulnerability.
Published:
Status: exploitable
Affected Solr versions: < 9.8.0
Core creation allows users to replace "trusted" configset files with arbitrary configuration
Solr instances are vulnerable if they:
FileSystemConfigSetService component (the default in "standalone" or "user-managed" mode), andIn this configuration, attackers can exploit a privilege escalation issue by replacing individual "trusted" configset files with potentially untrusted files from elsewhere on the filesystem.
These replacements are incorrectly treated as "trusted" and can leverage <lib> tags to add arbitrary code to Solr's classpath, potentially allowing malicious plugins or components to be loaded.
This issue affects all Apache Solr versions up through Solr 9.7.
Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService").
Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "
pwn null (reporter)
Status: not_affected
Affected Solr versions: all
The only places we use json-path is for querying (via Calcite) and for transforming/indexing custom JSON. Since the advisory describes a problem that is limited to the current thread, and users that are allowed to query/transform/index are already trusted to cause load to some extent, this advisory does not appear to have impact on the way json-path is used in Solr.
Status: not_affected
Affected Solr versions: 6.6.2-today
Solr does not ship a Struts jar. This is a transitive POM listing and not included with Solr (see comment in SOLR-2849).
Status: not_affected
Affected Solr versions: 7.3.1-today
All Tika issues that could be Solr vulnerabilities would only be exploitable if untrusted files are indexed with SolrCell. This is not recommended in production systems, so Solr does not consider these valid CVEs for Solr.
Status: not_affected
Affected Solr versions: < 9.1
Solr uses commons-text directly (StringEscapeUtils.escapeEcmaScript) in LoadAdminUiServlet that is not vulnerable. Solr also has a "hadoop-auth" module that uses Apache Hadoop which uses commons-text through commons-configuration2. For Solr, the concern is limited to loading Hadoop configuration files that would only ever be provided by trusted administrators, not externally (untrusted).
Status: exploitable
Affected Solr versions: 6.5-8.11.2, 9.0
Apache Calcite has a vulnerability, CVE-2022-39135, that is exploitable in Apache Solr in SolrCloud mode. If an untrusted user can supply SQL queries to Solr's '/sql' handler (even indirectly via proxies / other apps), then the user could perform an XML External Entity (XXE) attack. This might have been exposed by some deployers of Solr in order for internal analysts to use JDBC based tooling, but would have unlikely been granted to wider audiences.
Status: not_affected
Affected Solr versions: < 9.1
Solr uses commons-configuration2 for "hadoop-auth" only (for Kerberos). It is only used for loading Hadoop configuration files that would only ever be provided by trusted administrators, not externally (untrusted).
Status: not_affected
Affected Solr versions: < 9.1
The vulnerable code won't be used by Solr because Solr only is only using HDFS as a client.
Status: not_affected
Affected Solr versions: 7.4-8.11.1
The MDC data used by Solr are for the collection, shard, replica, core and node names, and a potential trace id, which are all sanitized. Furthermore, Solr's default log configuration doesn't use double-dollar-sign and we don't imagine a user would want to do that.
Status: not_affected
Affected Solr versions: 7.4-8.11.1
Solr's default log configuration doesn't use JDBCAppender and we don't imagine a user would want to use it or other obscure appenders.
Status: not_affected
Affected Solr versions: to present
JDOM is only used in Solr Cell, which should not be used in production which makes the vulnerability unexploitable. It is a dependency of Apache Tika, which has analyzed the issue and determined the vulnerability is limited to two libraries not commonly used in search applications, see TIKA-3488 for details. Since Tika should be used outside of Solr, use a version of Tika which updates the affected libraries if concerned about exposure to this issue.
Status: not_affected
Affected Solr versions: 7.3.0-present
Only exploitable if Solr's webapp directory is deployed as a symlink, which is not Solr's default.
Status: not_affected
Affected Solr versions: 7.3.0-8.8.0
Only exploitable through use of Jetty's GzipHandler, which is only implemented in Embedded Solr Server.
Status: not_affected
Affected Solr versions: 8.1.0- today
Solr's SQL adapter does not use the vulnerable class "HttpUtils". Calcite only used it to talk to Druid or Splunk.
Status: not_affected
Affected Solr versions: 8.2-8.3
This is not included in Solr but is a dependency of ZooKeeper 3.5.5. The version was upgraded in ZooKeeper 3.5.6, included with Solr 8.3. The specific classes mentioned in the CVE are not used in Solr (nor in ZooKeeper as far as the Solr community can determine).
Status: not_affected
Affected Solr versions: 7.7.0-8.2
Solr upgraded to Jetty 9.4.19 for the 8.2 release. Additionally, the path to exploit these vulnerabilities was fixed in 8.1 and 7.7.2. Earlier versions can manually patch their configurations as described in SOLR-13409.
Status: not_affected
Affected Solr versions: 8.0.0-8.3.0
While commons-beanutils was removed in 7.5, it was added back in 8.0 in error and removed again in 8.3. The vulnerable class was not used in any Solr code path. This jar remains a dependency of both Velocity and hadoop-common, but Solr does not use it in our implementations.
Status: not_affected
Affected Solr versions: 4.x-today
The reported CVE impacts org.slf4j.ext.EventData, which is not used in Solr.
Status: not_affected
Affected Solr versions: 5.4.0-7.7.2, 8.0-8.3
Dependency of Carrot2 and used during compilation, not at runtime (see SOLR-769. This .jar was replaced in Solr 8.3 and backported to 7.7.3 (see SOLR-13779).
Status: not_affected
Affected Solr versions: 7.3.1-7.5.0
Solr does not run tika-server, so this is not a problem.
Status: not_affected
Affected Solr versions: 5.4.0-today
Only used with the Carrot2 clustering engine.
Status: not_affected
Affected Solr versions: 4.6.0-today
Only used in tests.
Status: not_affected
Affected Solr versions: 4.6.0-today
Only used in Solr tests.
Status: not_affected
Affected Solr versions: 4.6.0-7.6.0
JUnit only used in tests; CVE only refers to a Jenkins plugin not used by Solr.
Status: not_affected
Affected Solr versions: 6.6.1-7.6.0
Does not impact Solr because Solr uses Hadoop as a client library.
Status: not_affected
Affected Solr versions: 4.7.0-today
These CVEs, and most of the known jackson-databind CVEs since 2017, are all related to problematic 'gadgets' that could be exploited during deserialization of untrusted data. The Jackson developers described 4 conditions that must be met in order for a problematic gadget to be exploited. See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062. Solr's use of jackson-databind does not meet 1 of the 4 conditions described which makes these CVEs unexploitable. The specific condition that Solr does not meet is the 3rd one: 'Enable polymorphic type handling' Solr does not include any polymorphic type handling, and Solr does not configure jackson-databind de/serialization to expect or include class names in serialized JSON. Two CVEs, 2019-14540 & 2019-16335, are related to HikariConfig and HikariDataSource classes, neither of which are used in Solr's code base.
Status: not_affected
Affected Solr versions: 6.0.0-7.5.0
Issue applies only to the C++ release of ICU and not ICU4J, which is what Lucene uses. ICU4J is at v63.2 as of Lucene/Solr 7.6.0
Status: not_affected
Affected Solr versions: 5.2.0-today
Solr should not be exposed outside a firewall where bad actors can send HTTP requests. These two CVEs specifically involve classes (SimpleXMLProvider and XmlRepresentation, respectively) that Solr does not use in any code path.
Status: not_affected
Affected Solr versions: 5.5.5, 6.2.0-today
See https://github.com/Gagravarr/VorbisJava/issues/30; reported CVEs are not related to OggVorbis at all.
Status: not_affected
Affected Solr versions: 6.5.0-today
Dependency for Hadoop and Calcite. ??
Status: not_affected
Affected Solr versions: 7.3.1
All of these issues apply to the C++ release of ICU and not ICU4J, which is what Lucene uses.
Status: not_affected
Affected Solr versions: 4.9.0-7.5.0
This is only used at compile time and it cannot be used to attack Solr. Since it is generally unnecessary, the dependency has been removed as of 7.5.0. See SOLR-12617.
Status: not_affected
Affected Solr versions: 4.6.0-today
Only used in test framework and at build time.
Status: not_affected
Affected Solr versions: ~2.9-today
Only used in Lucene Benchmarks and Solr tests.