CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request parameter
This vulnerability relates to an XML external entity expansion (XXE) in the
`&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be
used as XXE using file/ftp/http protocols in order to read arbitrary local
files from the Solr server or the internal network. See [1] for more details.
Mitigation:
Users are advised to upgrade to either Solr 6.6.3 or Solr 7.3.0 releases both
of which address the vulnerability. Once upgrade is complete, no other steps
are required. Those releases disable external entities in anonymous XML files
passed through this request parameter.
If users are unable to upgrade to Solr 6.6.3 or Solr 7.3.0 then they are
advised to disable data import handler in their solrconfig.xml file and
restart their Solr instances. Alternatively, if Solr instances are only used
locally without access to public internet, the vulnerability cannot be used
directly, so it may not be required to update, and instead reverse proxies or
Solr client applications should be guarded to not allow end users to inject
`dataConfig` request parameters.
Perl module that accepts an AES key and an encrypted one-time password
generated by a Yubikey device, and returns a decrypted authentication
token. For use in conjunction with other software that handles actual
authentication.
with tweaks from & ok sthen@
- Repeated output for 'dpctl' CLI command
- Iperf ignoring interrupt from CLI
- DPID value not passed to switch(4) nodes for assignment
- switch(4) nodes with control channels created later in startup won't have
their channels forwarded to a remote controller
- ping tests waiting forever when controller is explicitly disabled
- local forwarding controller not correctly tracked for teardown
- trying to log to extraneous file for switchd(8) node
- wrong method used for getting bridge(4) node info
- manpage for mn not generated properly
OK jca@ phessler@
OK for earlier version of diffs jasper@ sthen@
Includes changes for the following advisories:
ARM Trusted Firmware Security Advisory TFV 5
Not initializing or saving/restoring PMCR_EL0 can leak secure world
timing information
Arm Trusted Firmware Security Advisory TFV 6
Arm Trusted Firmware exposure to speculative processor vulnerabilities
using cache timing side-channels
Tested by kettenis@ on RK3399, the only platform we currently build in
this port. ok kettenis@
