Details
-
Sub-task
-
Status: Closed
-
Major
-
Resolution: Fixed
-
Upcoming Branch
-
None
-
Bug Crush Event - 21/2/2015
Description
It's not a CVE, no backport needed. For details, see
https://lucene.apache.org/core/8_11_3/changes/Changes.html
Actually few hours later Solr announced 4 CVEs:
https://solr.apache.org/security.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions
https://solr.apache.org/security.html#cve-2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property-redaction-logic-inconsistencies
https://solr.staged.apache.org/security.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets
https://solr.staged.apache.org/security.html#cve-2023-50292-apache-solr-schema-designer-blindly-trusts-all-configsets-possibly-leading-to-rce-by-unauthenticated-users