[ 
https://issues.apache.org/jira/browse/SOLR-13984?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16985382#comment-16985382
 ] 

Ishan Chattopadhyaya commented on SOLR-13984:
---------------------------------------------

Can someone with the expertise on this please take this up? Also, should we 
mark this as a release blocker for 9.0?

> Solr should run inside a SecurityManager
> ----------------------------------------
>
>                 Key: SOLR-13984
>                 URL: https://issues.apache.org/jira/browse/SOLR-13984
>             Project: Solr
>          Issue Type: Improvement
>      Security Level: Public(Default Security Level. Issues are Public) 
>            Reporter: Ishan Chattopadhyaya
>            Priority: Major
>
> To reduce the effect of attacks, esp. RCE, Solr should run inside a 
> SecurityManager.
> Quoting Uwe here:
> {quote}
> The correct way to fix all issues we have seen the last time is very simple: 
> LET'S RUN SOLR INSIDE A SECURITY MANAGER IN PRODUCTION (like in tests). 
> Elasticsearch is doing this, so please please let's do this instead. But this 
> requires to finally get rid of the webapplication and start.jar and add our 
> own bootstrapping (like in tests) that configure Jetty and Security Manager 
> from our own org.apache.solr.bootstrap.Main.java (or similar).
> {quote}
> https://jira.apache.org/jira/browse/SOLR-12316?focusedCommentId=16465038&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-16465038



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org

Reply via email to