>- What parts of Solr actually use Jackson (I thought noggit was used
> >for the JSON de/serialization)?
> >- Do any of the object mappers used enable default typing? (which is
> >necessary to exploit CVE-2017-7525
> >
> https://adamcaudill.com/2017
? (which is
>necessary to exploit CVE-2017-7525
>https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
>)
>- Is polymorphism used with Jackson without restricting subtypes (e.g.
>@JsonTypeInfo with JsonTypeInfo.Id.CLASS, which allows other exploits
f the object mappers used enable default typing? (which is
necessary to exploit CVE-2017-7525
https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
)
- Is polymorphism used with Jackson without restricting subtypes (e.g.
@JsonTypeInfo with JsonTypeInfo.Id.CLASS,
, Dec 18, 2019 at 8:44 AM Mehai, Lotfi
wrote:
> Hello;
>
> We are using Solr 7.7.0. The CVE-2017-7525 have been fixed for Solr 8.x.
> https://issues.apache.org/jira/browse/SOLR-13110
>
> When the fix will be available for Solr 7.7.x
>
> Lotfi
>
Hello;
We are using Solr 7.7.0. The CVE-2017-7525 have been fixed for Solr 8.x.
https://issues.apache.org/jira/browse/SOLR-13110
When the fix will be available for Solr 7.7.x
Lotfi
adjacent
> web endpoint via a GET request.
>
> Note that this can only impact you if your Solr instance can be directly
> accessed by untrusted sources.
>
> HTH
>
> On Thu, Feb 28, 2019 at 11:54 AM Jeff Courtade
> wrote:
>
> > This particular cve came out in the
our Solr instance can be directly
> accessed by untrusted sources.
>
> HTH
>
> On Thu, Feb 28, 2019 at 11:54 AM Jeff Courtade
> wrote:
>
>> This particular cve came out in the mailing list. Fed 12th
>>
>>
>> CVE-2017-3164 SSRF issue in Apache
28, 2019 at 11:54 AM Jeff Courtade
wrote:
> This particular cve came out in the mailing list. Fed 12th
>
>
> CVE-2017-3164 SSRF issue in Apache Solr
>
> I need to know what the exploit for this could be?
>
>
> can a user send a bogus shards param via a web request an
This particular cve came out in the mailing list. Fed 12th
CVE-2017-3164 SSRF issue in Apache Solr
I need to know what the exploit for this could be?
can a user send a bogus shards param via a web request and get a local file?
What does an attack vector look like for this?
I am being
CVE-2017-3164 SSRF issue in Apache Solr
Severity: High
Vendor: The Apache Software Foundation
Versions Affected:
Apache Solr versions from 1.3 to 7.6.0
Description:
The "shards" parameter does not have a corresponding whitelist mechanism,
so it can request any URL.
Mitigation:
Hi,Is solr affected by these two vulnerabilities CVE-2017-15718 and
CVE-2017-15713?
ThanksMikhail
version of Solr (I know, you may not be able
to).
Cheers -- Rick
On November 20, 2017 4:01:47 AM EST, padmanabhan gonesani
wrote:
>Please help me here
>
>
>
>-- Forwarded message --
>From: padmanabhan gonesani
>Date: Mon, Nov 13, 2017 at 5:12 PM
&g
Please help me here
-- Forwarded message --
From: padmanabhan gonesani
Date: Mon, Nov 13, 2017 at 5:12 PM
Subject: CVE-2017-3163 - SOLR-5.2.1 version
To: gene...@lucene.apache.org
Hi Team,
*Description:* Apache Solr could allow a remote attacker to traverse
directories
CVE-2017-12629: Several critical vulnerabilities discovered in Apache
Solr (XXE & RCE)
Severity: Critical
Vendor:
The Apache Software Foundation
Versions Affected:
Solr 5.5.0 to 5.5.4
Solr 6.0.0 to 6.6.1
Solr 7.0.0 to 7.0.1
Description:
The details of this vulnerability were reported on pu
Sorry,
I missed the post from Florian Gleixner:
>Re: Several critical vulnerabilities discovered in Apache Solr (XXE & RCE)
Am 16.10.2017 um 16:52 schrieb Uwe Reh:
Hi,
I'm still using V4.10. Is this version also vulnerable by
http://openwall.com/lists/oss-security/2017/10/13/1 ?
Uwe
Hi,
I'm still using V4.10. Is this version also vulnerable by
http://openwall.com/lists/oss-security/2017/10/13/1 ?
Uwe
CVE-2017-9803: Security vulnerability in kerberos delegation token functionality
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Apache Solr 6.2.0 to 6.6.0
Description:
Solr's Kerberos plugin can be configured to use delegation tokens,
which allows an applic
CVE-2017-7660: Security Vulnerability in secure inter-node
communication in Apache Solr
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Solr 5.3 to 5.5.4
Solr 6.0 to 6.5.1
Description:
Solr uses a PKI based mechanism to secure inter-node communication
when
CVE-2017-3163: Apache Solr ReplicationHandler path traversal attack
Severity: Moderate
Vendor:
The Apache Software Foundation
Versions Affected:
Solr 1.4 to 6.4.0
Description:
When using the Index Replication feature, Solr nodes can pull index files from
a master/leader node using an HTTP API
19 matches
Mail list logo
