Red Hat Security Advisory

RHSA-2017:3452

rh-java-common-lucene5 security update

Released 2017-12-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-lucene5-5.4.1-2.4.el6, rh-java-common-lucene5-analysis-5.4.1-2.4.el6, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el6 +17
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-lucene5-5.4.1-2.4.el7, rh-java-common-lucene5-analysis-5.4.1-2.4.el7, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el7 +17
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-java-common-lucene5-5.4.1-2.4.el6, rh-java-common-lucene5-analysis-5.4.1-2.4.el6, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el6 +17
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-java-common-lucene5-5.4.1-2.4.el7, rh-java-common-lucene5-analysis-5.4.1-2.4.el7, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el7 +17
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-java-common-lucene5-5.4.1-2.4.el7, rh-java-common-lucene5-analysis-5.4.1-2.4.el7, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el7 +17
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-lucene5-5.4.1-2.4.el6, rh-java-common-lucene5-analysis-5.4.1-2.4.el6, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el6 +17
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-lucene5-5.4.1-2.4.el7, rh-java-common-lucene5-analysis-5.4.1-2.4.el7, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el7 +17

Fixes 1 record

TI-2017-09354 CVE-2017-12629 · GHSA-mh7g-99w9-xpjm

XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1

CRITICAL 85

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.91896 Published 2017-10-14 Partial fix · lucene-solr 7.2.0, lucene-solr 8.0.0 +4 CWE-611