Read the docs
TI-2017-09354 Aliases CVE-2017-12629GHSA-mh7g-99w9-xpjm

XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1

Priority CRITICAL 85CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 14 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

Why it matters now

EPSS 0.91896 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Partial Apache Solr before 7.1 with Apache Lucene before 7.1: lucene-solr 7.2.0, lucene-solr 8.0.0, 7.1.0 +1org.apache.solr:solr-core (Maven): 7.1.0, 6.6.2, 5.5.5Red Hat: 11 advisoriesRed Hat: 14 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache Solr before 7.1 with Apache Lucene before 7.1Apache Solr before 7.1 with Apache Lucene before 7.1; lucene-solr to before 7.1.0lucene-solr 7.2.0, lucene-solr 8.0.0, 7.1.0Patch availableCNA
—Apache Solr before 7.1 with Apache Lucene before 7.1lucene-solr to before 5.3.1-redhat-25.3.1-redhat-2Patch availableCNA
—org.apache.solr:solr-core (Maven)7.0.0 to before 7.1.07.1.0Patch availableGHSA-mh7g-99w9-xpjm
—org.apache.solr:solr-core (Maven)6.0.0 to before 6.6.26.6.2Patch availableGHSA-mh7g-99w9-xpjm
—org.apache.solr:solr-core (Maven)5.5.0 to before 5.5.55.5.5Patch availableGHSA-mh7g-99w9-xpjm
  • Apache Solr before 7.1 with Apache Lucene before 7.1 Vendor— Affected Apache Solr before 7.1 with Apache Lucene before 7.1; lucene-solr to before 7.1.0 Fixed in lucene-solr 7.2.0, lucene-solr 8.0.0, 7.1.0 Patch available CNA
  • Apache Solr before 7.1 with Apache Lucene before 7.1 Vendor— Affected lucene-solr to before 5.3.1-redhat-2 Fixed in 5.3.1-redhat-2 Patch available CNA
  • org.apache.solr:solr-core (Maven) Vendor— Affected 7.0.0 to before 7.1.0 Fixed in 7.1.0 Patch available GHSA-mh7g-99w9-xpjm
  • org.apache.solr:solr-core (Maven) Vendor— Affected 6.0.0 to before 6.6.2 Fixed in 6.6.2 Patch available GHSA-mh7g-99w9-xpjm
  • org.apache.solr:solr-core (Maven) Vendor— Affected 5.5.0 to before 5.5.5 Fixed in 5.5.5 Patch available GHSA-mh7g-99w9-xpjm

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*5.5.0 – 5.5.4; 6.0.0 – 6.6.1; 7.0.0 – 7.0.1VulnerableApache
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
  • cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* Versions 5.5.0 – 5.5.4; 6.0.0 – 6.6.1; 7.0.0 – 7.0.1 Vulnerable ·Apache
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical

Remediation

  • Fix · CNA Apache Solr before 7.1 with Apache Lucene before 7.1 Fixed in lucene-solr 7.2.0, lucene-solr 8.0.0, 7.1.0
  • Fix · CNA Apache Solr before 7.1 with Apache Lucene before 7.1 Fixed in 5.3.1-redhat-2
  • Fix · GHSA-mh7g-99w9-xpjm org.apache.solr:solr-core (Maven) Fixed in 7.1.0 Advisory →
  • Fix · GHSA-mh7g-99w9-xpjm org.apache.solr:solr-core (Maven) Fixed in 6.6.2 Advisory →
  • Fix · GHSA-mh7g-99w9-xpjm org.apache.solr:solr-core (Maven) Fixed in 5.5.5 Advisory →

Red Hat 11 advisories

  • RHSA-2023:1334 Released 2023-03-20 · Red Hat rating Critical
    Red Hat Process Automation Manager 7.13.2 security update
    • RHPAM 7.13.1 async
  • RHSA-2020:2561 Released 2020-06-15 · Red Hat rating Critical
    EAP Continuous Delivery Technical Preview Release 12 security update
    • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • RHSA-2018:0005 Released 2018-01-03 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el7
Show 8 more Red Hat advisories
  • RHSA-2018:0004 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el7 +47
  • RHSA-2018:0002 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el6 +47
  • RHSA-2018:0003 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update
    • Red Hat JBoss EAP 7.0
  • RHSA-2017:3452 Released 2017-12-12 · Red Hat rating Moderate
    rh-java-common-lucene5 security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-lucene5-5.4.1-2.4.el6, rh-java-common-lucene5-analysis-5.4.1-2.4.el6, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el6 +17
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-lucene5-5.4.1-2.4.el7, rh-java-common-lucene5-analysis-5.4.1-2.4.el7, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el7 +17
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-java-common-lucene5-5.4.1-2.4.el6, rh-java-common-lucene5-analysis-5.4.1-2.4.el6, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el6 +17
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-java-common-lucene5-5.4.1-2.4.el7, rh-java-common-lucene5-analysis-5.4.1-2.4.el7, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el7 +17
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-java-common-lucene5-5.4.1-2.4.el7, rh-java-common-lucene5-analysis-5.4.1-2.4.el7, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el7 +17
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-lucene5-5.4.1-2.4.el6, rh-java-common-lucene5-analysis-5.4.1-2.4.el6, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el6 +17
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-lucene5-5.4.1-2.4.el7, rh-java-common-lucene5-analysis-5.4.1-2.4.el7, rh-java-common-lucene5-analyzers-smartcn-5.4.1-2.4.el7 +17
  • RHSA-2017:3451 Released 2017-12-12 · Red Hat rating Moderate
    rh-java-common-lucene security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-lucene-4.8.0-6.9.el6, rh-java-common-lucene-analysis-4.8.0-6.9.el6, rh-java-common-lucene-analyzers-phonetic-4.8.0-6.9.el6 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-lucene-4.8.0-6.9.el7, rh-java-common-lucene-analysis-4.8.0-6.9.el7, rh-java-common-lucene-analyzers-phonetic-4.8.0-6.9.el7 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-java-common-lucene-4.8.0-6.9.el6, rh-java-common-lucene-analysis-4.8.0-6.9.el6, rh-java-common-lucene-analyzers-phonetic-4.8.0-6.9.el6 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-java-common-lucene-4.8.0-6.9.el7, rh-java-common-lucene-analysis-4.8.0-6.9.el7, rh-java-common-lucene-analyzers-phonetic-4.8.0-6.9.el7 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-java-common-lucene-4.8.0-6.9.el7, rh-java-common-lucene-analysis-4.8.0-6.9.el7, rh-java-common-lucene-analyzers-phonetic-4.8.0-6.9.el7 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-lucene-4.8.0-6.9.el6, rh-java-common-lucene-analysis-4.8.0-6.9.el6, rh-java-common-lucene-analyzers-phonetic-4.8.0-6.9.el6 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-lucene-4.8.0-6.9.el7, rh-java-common-lucene-analysis-4.8.0-6.9.el7, rh-java-common-lucene-analyzers-phonetic-4.8.0-6.9.el7 +18
  • RHSA-2017:3244 Released 2017-11-16 · Red Hat rating Important
    Red Hat JBoss Data Grid 7.1.1 security update
    • Red Hat JBoss Data Grid 7.1
  • RHSA-2017:3123 Released 2017-11-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el6, eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el6, eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el6 +5
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el7, eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el7, eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el7 +5
  • RHSA-2017:3124 Released 2017-11-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.0 security update

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix yet
RHPAM 7.13.1 asyncFixed RHSA-2023:1334
Red Hat JBoss Data Grid 7.1Fixed RHSA-2017:3244
Red Hat JBoss EAP 7.0Fixed RHSA-2018:0003
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:3123, RHSA-2018:0002, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:3123, RHSA-2018:0004, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.0 security updateFixed RHSA-2017:3124
Red Hat JBoss Enterprise Application Platform Continuous DeliveryFixed RHSA-2020:2561
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2017:3451, RHSA-2017:3452
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:3451, RHSA-2017:3452
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)Fixed RHSA-2017:3451, RHSA-2017:3452
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2017:3451, RHSA-2017:3452
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2017:3451, RHSA-2017:3452
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2017:3451, RHSA-2017:3452
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:3451, RHSA-2017:3452
Not affected: 11 products
  • Red Hat BPM Suite 6
  • Red Hat Enterprise Linux 5
  • Red Hat Fuse 7
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Portal 6
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat Single Sign-On 7
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12629
  2. 2026-10-03 Alias added: GHSA-mh7g-99w9-xpjm
  3. 2026-11-05 Fix available: Red Hat JBoss EAP 7.0 · Red Hat

References

Exploit 2

Advisory 19

Other 15

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences