5f0f3115d0
CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request parameter This vulnerability relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. See [1] for more details. Mitigation: Users are advised to upgrade to either Solr 6.6.3 or Solr 7.3.0 releases both of which address the vulnerability. Once upgrade is complete, no other steps are required. Those releases disable external entities in anonymous XML files passed through this request parameter. If users are unable to upgrade to Solr 6.6.3 or Solr 7.3.0 then they are advised to disable data import handler in their solrconfig.xml file and restart their Solr instances. Alternatively, if Solr instances are only used locally without access to public internet, the vulnerability cannot be used directly, so it may not be required to update, and instead reverse proxies or Solr client applications should be guarded to not allow end users to inject `dataConfig` request parameters.
3 lines
105 B
Plaintext
3 lines
105 B
Plaintext
SHA256 (solr-7.3.0.tgz) = S5ufXf1OpLD99pvalSjeR5A6qpvZxctAXOCuCajRL+k=
|
|
SIZE (solr-7.3.0.tgz) = 162081102
|