[
https://issues.apache.org/jira/browse/SOLR-15324?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17445928#comment-17445928
]
David Eric Pugh commented on SOLR-15324:
----------------------------------------
I'll also point out that it isn't uncommon for more sophisticated users of Solr
to use the un released version of Solr directly by building it, or to maintain
their own patches on top of a released version of Solr. This could be an
approach for you to get these types of fixes faster!
> High security vulnerability in Apache Thrift - CVE-2020-13949 (+1) bundled
> within Solr
> --------------------------------------------------------------------------------------
>
> Key: SOLR-15324
> URL: https://issues.apache.org/jira/browse/SOLR-15324
> Project: Solr
> Issue Type: Bug
> Components: JaegerTracer
> Affects Versions: 8.8.1
> Reporter: WCM RnD
> Assignee: Jan Høydahl
> Priority: Major
> Fix For: main (9.0)
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Latest Version of Solr 8.8.1 bundles Apache v0.13.0. Thrift jar that has the
> following vulnerabilities:
> h1. Vulnerability Details
> h2. CVE-2020-13949
> *Vulnerability Published:* 2021-02-12 15:15 EST
> *Vulnerability Updated:* 2021-02-18 10:43 EST
> *CVSS Score:* {color:#ff0000}7.5{color} (overall), {color:#ff0000}7.5{color}
> (base)
> *Summary*: In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send
> short messages which would result in a large memory allocation, potentially
> leading to denial of service.
> *Solution*: N/A
> *Workaround*: N/A
> h2. BDSA-2021-0373
> *Affected Component(s):* Apache Thrift
> *Vulnerability Published:* 2021-02-15 10:38 EST
> *Vulnerability Updated:* 2021-02-15 10:38 EST
> *CVSS Score:* 6.5 (overall), {color:#ff0000}7.5{color} (base)
> *Summary*: Apache Thrift contains a denial-of-service (DoS) vulnerability.
> Successfully exploiting this could allow an attacker to crash the application.
> *Solution*: Fixed in
> [*0.14.0*|https://github.com/apache/thrift/releases/tag/v0.14.0].
> The latest stable releases are available
> [here|https://thrift.apache.org/download.html].
> *Workaround*: N/A
>
> *Apache Thrift jar needs to be updated to 0.14.0 to fix the above
> vulnerability*
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For additional commands, e-mail: issues-h...@solr.apache.org
