CVE-2019-17558
Description
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
How to fix
Apply updates per vendor instructions.
CISA due date: May 3, 2022- apache solr7.7.3, 8.4.0 or later
- org.apache.solr:solr-core8.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache solr | 5.0.0 ≤ v < 7.7.3, 8.0.0 ≤ v < 8.4.0 | 7.7.3, 8.4.0 |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 16.1, 16.2, 18.8, 19.12 | — |
| org.apache.solr:solr-coreMaven | 5.0.0 ≤ v < 8.4.0, 6.0.0 ≤ v < 8.4.0, 7.0.0 ≤ v < 8.4.0, 8.0.0 ≤ v < 8.4.0 | 8.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.