Hariprasad T created SOLR-16537:
-----------------------------------
Summary: Apache Solr Remote Code Execution Vulnerability
Key: SOLR-16537
URL: https://issues.apache.org/jira/browse/SOLR-16537
Project: Solr
Issue Type: Task
Security Level: Public (Default Security Level. Issues are Public)
Reporter: Hariprasad T
We have a Sitecore project with the version 9.3 and we are using windows Solr
8.1.1. We have this Vulnerability "Apache Solr Remote Code Execution
Vulnerability" impacted on few of our servers. And below are the patch fix
suggested by Solr for this vulnerability.
*Ref:* SOLR-13971 -CVE-2019-17558
*URL:*
[https://solr.apache.org/security.html#cve-2019-17558-apache-solr-rce-through-velocityresponsewriter]
*Impacted Servers:*
Many servers like TST, STG, Prod.
*Mitigation:*
*(a) Ensure your network settings are configured so that only trusted traffic
communicates with Solr, especially to the configuration APIs
https://solr.apache.org/guide/solr/latest/deployment-guide/securing-solr.html*
*(i) Authentication and Authorization*
We don't have this file in our project's solr version 8.1.1. Please check and
let us know where we can find this file Security.json. Please advise.
*(ii) IP Access Control*
Restrict network access to specific hosts, by setting
SOLR_IP_ALLOWLIST/SOLR_IP_DENYLIST via environment variables or in
solr.in.sh/solr.in.cmd.
We don't have this attribute in the above files. Please advise.
or it would be great if you can suggest any other solution to fix this
vulnerability.
Thanks in advance!
Regards,
Hariprasad T
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For additional commands, e-mail: issues-h...@solr.apache.org
