This is an automated email from the ASF dual-hosted git repository.
git-site-role pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new d34c28c61 Automatic Site Publish by Buildbot
d34c28c61 is described below
commit d34c28c613cc873efc7a2a5df1934c894ce5029f
Author: buildbot <[email protected]>
AuthorDate: Wed Nov 23 08:17:51 2022 +0000
Automatic Site Publish by Buildbot
---
output/feeds/all.atom.xml | 23 ++++++++++++-
output/feeds/solr/security.atom.xml | 23 ++++++++++++-
output/index.html | 2 +-
output/news.html | 21 +++++++++++
output/operator/index.html | 2 +-
output/security.html | 69 +++++++++++++++----------------------
6 files changed, 94 insertions(+), 46 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index bbda3d64f..5f187e8f1 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,26 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"></link><link href="/feeds/all.atom.xml"
rel="self"></link><id>/</id><updated>2022-11-17T00:00:00+00:00</updated><subtitle></subtitle><subtitle></subtitle><entry><title>Apache
Solr™ 9.1.0 available</title><link href="/apache-solrtm-910-available.html"
rel="alternate"></link><published>2022-11-17T00:00:00+00:00</published><updated>2022-11-17T00:00:00+00:00</updated><author><name>Solr
Develope [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"></link><link href="/feeds/all.atom.xml"
rel="self"></link><id>/</id><updated>2022-11-20T00:00:00+00:00</updated><subtitle></subtitle><subtitle></subtitle><entry><title>Apache
Solr is vulnerable to CVE-2022-39135 via /sql handler</title><link
href="/apache-solr-is-vulnerable-to-cve-2022-39135-via-sql-handler.html"
rel="alternate"></link><published>2022-11-20T00:00:00+00:00</published><update
[...]
+Solr 6.5 to 8.11.2
+Solr 9.0</p>
+<p><strong>Description:</strong>
+Apache Calcite has a vulnerability, CVE-2022-39135, that is exploitable in
Apache Solr in SolrCloud mode. If an untrusted user can supply SQL queries to
Solr’s “/sql” handler (even indirectly via proxies / other apps), then the user
…</p></summary><content type="html"><p><strong>Versions
Affected:</strong>
+Solr 6.5 to 8.11.2
+Solr 9.0</p>
+<p><strong>Description:</strong>
+Apache Calcite has a vulnerability, CVE-2022-39135, that is exploitable in
Apache Solr in SolrCloud mode. If an untrusted user can supply SQL queries to
Solr’s “/sql” handler (even indirectly via proxies / other apps), then the user
could perform an XML External Entity (XXE) attack. This might have been
exposed by some deployers of Solr in order for internal analysts to use JDBC
based tooling, but would have unlikely been granted to wider
audiences.</p>
+<p><strong>Impact:</strong>
+An XXE attack may lead to the disclosure of confidential data, denial of
service, server side request forgery (SSRF), port scanning from the Solr node,
and other system impacts.</p>
+<p><strong>Mitigation:</strong>
+Most Solr installations don’t make use of the SQL functionality. For such
users, the standard Solr security advice of using a firewall should be
adequate. Nonetheless, the functionality can be disabled. As of Solr 9, it
has been modularized and thus became opt-in, so nothing is needed for Solr 9
users that don’t use it. Users <em>not</em> using SolrCloud can’t
use the functionality at all. For other users that wish to disable it, you
must register a request handler that [...]
+<div
class="codehilite"><pre><span></span><code><span
class="err"> &lt;requestHandler name=&quot;/sql&quot;
class=&quot;solr.NotFoundRequestHandler&quot;/&gt;</span>
+</code></pre></div>
+
+<p>Users needing this SQL functionality are forced to upgrade to Solr
9.1. If Solr 8.11.3 is released, then it will be an option as well. Simply
replacing Calcite and other JAR files may mostly work but could fail depending
on the particulars of the query. Users interested in this or in patching their
own versions of Solr should examine SOLR-16421 for a source patch.</p>
+<p><strong>Credit:</strong>
+Andreas Hubold at CoreMedia GmbH</p>
+<p><strong>References:</strong>
+https://nvd.nist.gov/vuln/detail/CVE-2022-39135
+https://issues.apache.org/jira/browse/SOLR-16421</p></content><category
term="solr/security"></category></entry><entry><title>Apache Solr™ 9.1.0
available</title><link href="/apache-solrtm-910-available.html"
rel="alternate"></link><published>2022-11-17T00:00:00+00:00</published><updated>2022-11-17T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-11-17:/apache-solrtm-910-available.html</id><summary
type="html"><p>The Solr PMC is pleased t [...]
<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Solr project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p></summary><content
type="html"><p>The Solr PMC is pleased to announce the release of Apache
Solr 9.1.0.</p>
<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Solr project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and geospatial search. Solr is highly
scalable, providing fault tolerant distributed search and indexing, and powers
the search and navigation features of many of the world's largest internet
sites.</p>
<p>Solr 9.1.0 is available for immediate download at:</p>
diff --git a/output/feeds/solr/security.atom.xml
b/output/feeds/solr/security.atom.xml
index 52e9d2ac5..bf272a90a 100644
--- a/output/feeds/solr/security.atom.xml
+++ b/output/feeds/solr/security.atom.xml
@@ -1,5 +1,26 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/security</title><link href="/" rel="alternate"></link><link
href="/feeds/solr/security.atom.xml"
rel="self"></link><id>/</id><updated>2021-12-18T00:00:00+00:00</updated><subtitle></subtitle><subtitle></subtitle><entry><title>CVE-2021-44548:
Apache Solr information disclosure vulnerability through
DataImportHandler</title><link
href="/cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandle
[...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/security</title><link href="/" rel="alternate"></link><link
href="/feeds/solr/security.atom.xml"
rel="self"></link><id>/</id><updated>2022-11-20T00:00:00+00:00</updated><subtitle></subtitle><subtitle></subtitle><entry><title>Apache
Solr is vulnerable to CVE-2022-39135 via /sql handler</title><link
href="/apache-solr-is-vulnerable-to-cve-2022-39135-via-sql-handler.html"
rel="alternate"></link><published>2022-11-20T00:00:0 [...]
+Solr 6.5 to 8.11.2
+Solr 9.0</p>
+<p><strong>Description:</strong>
+Apache Calcite has a vulnerability, CVE-2022-39135, that is exploitable in
Apache Solr in SolrCloud mode. If an untrusted user can supply SQL queries to
Solr’s “/sql” handler (even indirectly via proxies / other apps), then the user
…</p></summary><content type="html"><p><strong>Versions
Affected:</strong>
+Solr 6.5 to 8.11.2
+Solr 9.0</p>
+<p><strong>Description:</strong>
+Apache Calcite has a vulnerability, CVE-2022-39135, that is exploitable in
Apache Solr in SolrCloud mode. If an untrusted user can supply SQL queries to
Solr’s “/sql” handler (even indirectly via proxies / other apps), then the user
could perform an XML External Entity (XXE) attack. This might have been
exposed by some deployers of Solr in order for internal analysts to use JDBC
based tooling, but would have unlikely been granted to wider
audiences.</p>
+<p><strong>Impact:</strong>
+An XXE attack may lead to the disclosure of confidential data, denial of
service, server side request forgery (SSRF), port scanning from the Solr node,
and other system impacts.</p>
+<p><strong>Mitigation:</strong>
+Most Solr installations don’t make use of the SQL functionality. For such
users, the standard Solr security advice of using a firewall should be
adequate. Nonetheless, the functionality can be disabled. As of Solr 9, it
has been modularized and thus became opt-in, so nothing is needed for Solr 9
users that don’t use it. Users <em>not</em> using SolrCloud can’t
use the functionality at all. For other users that wish to disable it, you
must register a request handler that [...]
+<div
class="codehilite"><pre><span></span><code><span
class="err"> &lt;requestHandler name=&quot;/sql&quot;
class=&quot;solr.NotFoundRequestHandler&quot;/&gt;</span>
+</code></pre></div>
+
+<p>Users needing this SQL functionality are forced to upgrade to Solr
9.1. If Solr 8.11.3 is released, then it will be an option as well. Simply
replacing Calcite and other JAR files may mostly work but could fail depending
on the particulars of the query. Users interested in this or in patching their
own versions of Solr should examine SOLR-16421 for a source patch.</p>
+<p><strong>Credit:</strong>
+Andreas Hubold at CoreMedia GmbH</p>
+<p><strong>References:</strong>
+https://nvd.nist.gov/vuln/detail/CVE-2022-39135
+https://issues.apache.org/jira/browse/SOLR-16421</p></content><category
term="solr/security"></category></entry><entry><title>CVE-2021-44548: Apache
Solr information disclosure vulnerability through
DataImportHandler</title><link
href="/cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler.html"
rel="alternate"></link><published>2021-12-18T00:00:00+00:00</published><updated>2021-12-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></ [...]
Moderate</p>
<p><strong>Versions Affected:</strong><br>
All versions prior to 8.11.1. Affected platforms: Windows.</p>
diff --git a/output/index.html b/output/index.html
index 279c498cd..fe48aa289 100644
--- a/output/index.html
+++ b/output/index.html
@@ -112,7 +112,7 @@
</div>
<div class="header-fill"></div>
-<section class="security" latest-date="2021-12-18">
+<section class="security" latest-date="2022-11-20">
<div class="row">
<div class="large-12 columns text-center">
<h2><a href="security.html">⚠ There are recent security
announcements. Read more on the Security page.</a></h2>
diff --git a/output/news.html b/output/news.html
index 076252a4c..346e13e13 100644
--- a/output/news.html
+++ b/output/news.html
@@ -132,6 +132,27 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
<p>You may also read these news as an <a
href="/feeds/solr/news.atom.xml">ATOM feed</a>.</p>
+ <h2 id="apache-solr-is-vulnerable-to-cve-2022-39135-via-sql-handler">20
November 2022, Apache Solr is vulnerable to CVE-2022-39135 via /sql handler
+ <a class="headerlink"
href="#apache-solr-is-vulnerable-to-cve-2022-39135-via-sql-handler"
title="Permanent link">¶</a>
+ </h2>
+ <p><strong>Versions Affected:</strong>
+Solr 6.5 to 8.11.2
+Solr 9.0</p>
+<p><strong>Description:</strong>
+Apache Calcite has a vulnerability, CVE-2022-39135, that is exploitable in
Apache Solr in SolrCloud mode. If an untrusted user can supply SQL queries to
Solr’s “/sql” handler (even indirectly via proxies / other apps), then the user
could perform an XML External Entity (XXE) attack. This might have been
exposed by some deployers of Solr in order for internal analysts to use JDBC
based tooling, but would have unlikely been granted to wider audiences.</p>
+<p><strong>Impact:</strong>
+An XXE attack may lead to the disclosure of confidential data, denial of
service, server side request forgery (SSRF), port scanning from the Solr node,
and other system impacts.</p>
+<p><strong>Mitigation:</strong>
+Most Solr installations don’t make use of the SQL functionality. For such
users, the standard Solr security advice of using a firewall should be
adequate. Nonetheless, the functionality can be disabled. As of Solr 9, it
has been modularized and thus became opt-in, so nothing is needed for Solr 9
users that don’t use it. Users <em>not</em> using SolrCloud can’t use the
functionality at all. For other users that wish to disable it, you must
register a request handler that masks the un [...]
+<div class="codehilite"><pre><span></span><code><span class="err">
<requestHandler name="/sql"
class="solr.NotFoundRequestHandler"/></span>
+</code></pre></div>
+
+<p>Users needing this SQL functionality are forced to upgrade to Solr 9.1. If
Solr 8.11.3 is released, then it will be an option as well. Simply replacing
Calcite and other JAR files may mostly work but could fail depending on the
particulars of the query. Users interested in this or in patching their own
versions of Solr should examine SOLR-16421 for a source patch.</p>
+<p><strong>Credit:</strong>
+Andreas Hubold at CoreMedia GmbH</p>
+<p><strong>References:</strong>
+https://nvd.nist.gov/vuln/detail/CVE-2022-39135
+https://issues.apache.org/jira/browse/SOLR-16421</p>
<h2 id="apache-solrtm-910-available">17 November 2022, Apache Solr™ 9.1.0
available
<a class="headerlink" href="#apache-solrtm-910-available" title="Permanent
link">¶</a>
</h2>
diff --git a/output/operator/index.html b/output/operator/index.html
index f93022069..b65cac7af 100644
--- a/output/operator/index.html
+++ b/output/operator/index.html
@@ -107,7 +107,7 @@
</div>
<div class="header-fill"></div>
-<section class="security" latest-date="2021-12-18">
+<section class="security" latest-date="2022-11-20">
<div class="row">
<div class="large-12 columns text-center">
<h2><a href="/security.html">⚠ There are recent security
announcements. Read more on the Solr Security page.</a></h2>
diff --git a/output/security.html b/output/security.html
index 9e708d124..517fe27b0 100644
--- a/output/security.html
+++ b/output/security.html
@@ -165,6 +165,11 @@ The contact email for reporting newly discovered exploits
in Solr is <a href="&#
<th width="95">Date</th>
<th>Announcement</th>
</tr>
+ <tr>
+ <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2022-39135";>CVE-2022-39135</a></td>
+ <td>2022-11-20</td>
+ <td><a
href="#apache-solr-is-vulnerable-to-cve-2022-39135-via-sql-handler">Apache Solr
is vulnerable to CVE-2022-39135 via /sql handler</a></td>
+ </tr>
<tr>
<td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2021-44548";>CVE-2021-44548</a></td>
<td>2021-12-18</td>
@@ -235,13 +240,30 @@ The contact email for reporting newly discovered exploits
in Solr is <a href="&#
<td>2019-02-12</td>
<td><a href="#cve-2017-3164-ssrf-issue-in-apache-solr">SSRF issue
in Apache Solr</a></td>
</tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2018-1308";>CVE-2018-1308</a></td>
- <td>2018-04-08</td>
- <td><a
href="#cve-2018-1308-xxe-attack-through-apache-solrs-dihs-dataconfig-request-parameter">XXE
attack through Apache Solr's DIH's dataConfig request parameter</a></td>
- </tr>
</table>
+ <h2
id="apache-solr-is-vulnerable-to-cve-2022-39135-via-sql-handler">2022-11-20,
Apache Solr is vulnerable to CVE-2022-39135 via /sql handler
+ <a class="headerlink"
href="#apache-solr-is-vulnerable-to-cve-2022-39135-via-sql-handler"
title="Permanent link">¶</a>
+ </h2>
+ <p><strong>Versions Affected:</strong>
+Solr 6.5 to 8.11.2
+Solr 9.0</p>
+<p><strong>Description:</strong>
+Apache Calcite has a vulnerability, CVE-2022-39135, that is exploitable in
Apache Solr in SolrCloud mode. If an untrusted user can supply SQL queries to
Solr’s “/sql” handler (even indirectly via proxies / other apps), then the user
could perform an XML External Entity (XXE) attack. This might have been
exposed by some deployers of Solr in order for internal analysts to use JDBC
based tooling, but would have unlikely been granted to wider audiences.</p>
+<p><strong>Impact:</strong>
+An XXE attack may lead to the disclosure of confidential data, denial of
service, server side request forgery (SSRF), port scanning from the Solr node,
and other system impacts.</p>
+<p><strong>Mitigation:</strong>
+Most Solr installations don’t make use of the SQL functionality. For such
users, the standard Solr security advice of using a firewall should be
adequate. Nonetheless, the functionality can be disabled. As of Solr 9, it
has been modularized and thus became opt-in, so nothing is needed for Solr 9
users that don’t use it. Users <em>not</em> using SolrCloud can’t use the
functionality at all. For other users that wish to disable it, you must
register a request handler that masks the un [...]
+<div class="codehilite"><pre><span></span><code><span class="err">
<requestHandler name="/sql"
class="solr.NotFoundRequestHandler"/></span>
+</code></pre></div>
+
+<p>Users needing this SQL functionality are forced to upgrade to Solr 9.1. If
Solr 8.11.3 is released, then it will be an option as well. Simply replacing
Calcite and other JAR files may mostly work but could fail depending on the
particulars of the query. Users interested in this or in patching their own
versions of Solr should examine SOLR-16421 for a source patch.</p>
+<p><strong>Credit:</strong>
+Andreas Hubold at CoreMedia GmbH</p>
+<p><strong>References:</strong>
+https://nvd.nist.gov/vuln/detail/CVE-2022-39135
+https://issues.apache.org/jira/browse/SOLR-16421</p>
+ <hr/>
<h2
id="cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler">2021-12-18,
CVE-2021-44548: Apache Solr information disclosure vulnerability through
DataImportHandler
<a class="headerlink"
href="#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler"
title="Permanent link">¶</a>
</h2>
@@ -636,43 +658,6 @@ dk from Chaitin Tech</p>
<li><a
href="https://cwiki.apache.org/confluence/display/SOLR/SolrSecurity";>https://cwiki.apache.org/confluence/display/SOLR/SolrSecurity</a></li>
</ul>
<hr/>
- <h2
id="cve-2018-1308-xxe-attack-through-apache-solrs-dihs-dataconfig-request-parameter">2018-04-08,
CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request
parameter
- <a class="headerlink"
href="#cve-2018-1308-xxe-attack-through-apache-solrs-dihs-dataconfig-request-parameter"
title="Permanent link">¶</a>
- </h2>
- <p>CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request
parameter</p>
-<p><strong>Severity:</strong> Major</p>
-<p><strong>Vendor:</strong><br>
-The Apache Software Foundation</p>
-<p><strong>Versions Affected:</strong></p>
-<ul>
-<li>Solr 1.2 to 6.6.2</li>
-<li>Solr 7.0.0 to 7.2.1</li>
-</ul>
-<p><strong>Description:</strong><br>
-The details of this vulnerability were reported to the Apache Security mailing
list. </p>
-<p>This vulnerability relates to an XML external entity expansion (XXE) in the
-<code>&dataConfig=<inlinexml></code> parameter of Solr's
DataImportHandler. It can be
-used as XXE using file/ftp/http protocols in order to read arbitrary local
-files from the Solr server or the internal network. See [1] for more
details.</p>
-<p><strong>Mitigation:</strong><br>
-Users are advised to upgrade to either Solr 6.6.3 or Solr 7.3.0 releases both
-of which address the vulnerability. Once upgrade is complete, no other steps
-are required. Those releases disable external entities in anonymous XML files
-passed through this request parameter. </p>
-<p>If users are unable to upgrade to Solr 6.6.3 or Solr 7.3.0 then they are
-advised to disable data import handler in their solrconfig.xml file and
-restart their Solr instances. Alternatively, if Solr instances are only used
-locally without access to public internet, the vulnerability cannot be used
-directly, so it may not be required to update, and instead reverse proxies or
-Solr client applications should be guarded to not allow end users to inject
-<code>dataConfig</code> request parameters. Please refer to [2] on how to
correctly
-secure Solr servers.</p>
-<p><strong>Credit:</strong><br>
-麦 香浓郁</p>
-<p><strong>References:</strong></p>
-<p>[1] <a
href="https://issues.apache.org/jira/browse/SOLR-11971";>https://issues.apache.org/jira/browse/SOLR-11971</a><br>
-[2] <a
href="https://cwiki.apache.org/confluence/display/solr/SolrSecurity";>https://cwiki.apache.org/confluence/display/solr/SolrSecurity</a></p>
- <hr/>
</div>
</div>
</div>
