Red Hat Security Advisory

RHSA-2017:3123

Red Hat JBoss Enterprise Application Platform security update

Released 2017-11-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el6, eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el6, eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el6 +5
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el7, eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el7, eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el7 +5

Fixes 1 record

TI-2017-09354 CVE-2017-12629 · GHSA-mh7g-99w9-xpjm

XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1

CRITICAL 85

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.91896 Published 2017-10-14 Partial fix · lucene-solr 7.2.0, lucene-solr 8.0.0 +4 CWE-611