From announce-return-5058-archive-asf-public=cust-asf.ponee.io@apache.org Tue Feb 12 20:04:34 2019 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id E8609180675 for ; Tue, 12 Feb 2019 21:04:33 +0100 (CET) Received: (qmail 94550 invoked by uid 500); 12 Feb 2019 20:04:22 -0000 Mailing-List: contact announce-help@apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list announce@apache.org Delivered-To: moderator for announce@apache.org Received: (qmail 17321 invoked by uid 99); 12 Feb 2019 19:44:02 -0000 X-Gm-Message-State: AHQUAuZ5c8vp4XSnzprlNoj7NsJi1TnueFEzZ3qJ8Q0doBTR9frv3ZK0 hbwSxLeiSkV0iB13+ma0a0mP8+agPeXunIp2hno= X-Google-Smtp-Source: AHgI3IbGxC0GxTHKy62cMBTKsFd8baZxYOXRVA7D3UQJTQw493sWR/JhgvPDsMXSY0XgsIrPNqX440Q6T0zK1XPWVdw= X-Received: by 2002:aa7:80c6:: with SMTP id a6mr5704511pfn.40.1550000640841; Tue, 12 Feb 2019 11:44:00 -0800 (PST) MIME-Version: 1.0 From: Tomas Fernandez Lobbe Date: Tue, 12 Feb 2019 11:43:49 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: [SECURITY] CVE-2017-3164 SSRF issue in Apache Solr To: announce@apache.org, general@lucene.apache.org, dev@lucene.apache.org, solr-user@lucene.apache.org, security@lucene.apache.org Content-Type: multipart/alternative; boundary="000000000000995f2e0581b7a566" --000000000000995f2e0581b7a566 Content-Type: text/plain; charset="UTF-8" CVE-2017-3164 SSRF issue in Apache Solr Severity: High Vendor: The Apache Software Foundation Versions Affected: Apache Solr versions from 1.3 to 7.6.0 Description: The "shards" parameter does not have a corresponding whitelist mechanism, so it can request any URL. Mitigation: Upgrade to Apache Solr 7.7.0 or later. Ensure your network settings are configured so that only trusted traffic is allowed to ingress/egress your hosts running Solr. Credit: dk from Chaitin Tech References: https://issues.apache.org/jira/browse/SOLR-12770 https://wiki.apache.org/solr/SolrSecurity --000000000000995f2e0581b7a566 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
CVE-2017-3164 SSRF issue in Apache S= olr

Severity: High

Vendor: The Apache Software Foundation
=
Versions Affected:
Apache Solr versions from 1.3 to 7.6.0
=
Description:
The "shards" parameter does not have a corres= ponding whitelist mechanism, so it can request any URL.

Mitigation:<= br>Upgrade to Apache Solr 7.7.0 or later.
Ensure your network settings a= re configured so that only trusted traffic is allowed to ingress/egress you= r hosts running Solr.

Credit:
dk from Chaitin Tech

Referen= ces:
https://issues.apache.org/jira/browse/SOLR-12770
=
--000000000000995f2e0581b7a566--