This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new eabba31af Commit build products
eabba31af is described below
commit eabba31afd19b1ff037671ba8bf30615408098e9
Author: Build Pelican (action) <[email protected]>
AuthorDate: Wed May 20 08:26:31 2026 +0000
Commit build products
---
output/blog.html | 14 +++
.../scaling-solr-mental-model.html} | 109 ++-------------------
.../solr-lucene-migration-correctness.html} | 109 ++-------------------
output/feeds/all.atom.xml | 68 ++++++++-----
output/feeds/solr/security.atom.xml | 45 ++++++++-
output/index.html | 2 +-
output/news.html | 37 +++++++
output/operator/index.html | 2 +-
output/posts.html | 62 ++++++------
output/posts2.html | 70 ++++++-------
output/posts3.html | 78 +++++++--------
output/posts4.html | 78 +++++++--------
output/posts5.html | 78 +++++++--------
output/posts6.html | 78 +++++++--------
output/posts7.html | 78 +++++++--------
output/posts8.html | 78 +++++++--------
output/posts9.html | 39 ++++++++
output/security-news.html | 63 +++++++-----
output/security-news2.html | 25 +++++
output/security-reporting.html | 2 +-
output/security.html | 14 +--
21 files changed, 565 insertions(+), 564 deletions(-)
diff --git a/output/blog.html b/output/blog.html
index b4ce2371d..6fe1278c2 100644
--- a/output/blog.html
+++ b/output/blog.html
@@ -150,6 +150,13 @@ If you have one you'd like to contribute, or would like to
link out to an extern
<hr/>
+ <h2 id="solr-lucene-migration-correctness">
+ <a href="blogposts/solr-lucene-migration-correctness.html">
+ Validating Ranking Correctness During Solr/Lucene Migrations
+ </a>
+ </h2>
+ <h5>Published: 2 May 2026</h5>
+ <p><p>A practical article on detecting ranking behavior drift during major
Solr/Lucene upgrades using side-by-side validation of candidate overlap, rank
deltas, score distribution drift, and latency behavior. Written by Parveen
Saini.</p></p>
<h2
id="solr-autogeneratephrasequeries-and-minimum-should-match-with-synonyms">
<a
href="blogposts/solr-autogeneratephrasequeries-and-minimum-should-match-with-synonyms.html">
Solr AutoGeneratePhraseQueries and Minimum Should Match with Synonyms
@@ -171,6 +178,13 @@ If you have one you'd like to contribute, or would like to
link out to an extern
</h2>
<h5>Published: 26 November 2024</h5>
<p><p>Let's explore whether to index a field in Apache Solr as a string or
integer for optimal filter query performance. Written by Ilaria Petreti,
Information Retrieval/Machine Learning Engineer at Sease.</p></p>
+ <h2 id="scaling-solr-mental-model">
+ <a href="blogposts/scaling-solr-mental-model.html">
+ Scaling Solr: From Desktop to Cloud Scale
+ </a>
+ </h2>
+ <h5>Published: 9 November 2024</h5>
+ <p><p>This blog post is a opinion piece on how to make Solr deployments
scale easily from small to massive. Written by Eric Pugh.</p></p>
<h2 id="community-over-code-na-2024-birds-of-a-feather">
<a href="blogposts/community-over-code-na-2024-birds-of-a-feather.html">
Community Over Code NA 2024 Apache Lucene/Solr Birds Of A Feather
diff --git a/output/security.html
b/output/blogposts/scaling-solr-mental-model.html
similarity index 60%
copy from output/security.html
copy to output/blogposts/scaling-solr-mental-model.html
index edf59fb71..64d56093e 100644
--- a/output/security.html
+++ b/output/blogposts/scaling-solr-mental-model.html
@@ -37,21 +37,21 @@
<script
src="/theme/javascript/lib/foundation/foundation.min.js?v=033782dc"></script>
<script
src="/theme/javascript/lib/jquery.smooth-scroll.min.js?v=033782dc"></script>
<script src="/theme/javascript/main.js?v=033782dc"></script>
-<script src="https://www.apachecon.com/event-images/snippet.js";></script>
<title>Solr™ Security - Apache Solr</title>
+<script src="https://www.apachecon.com/event-images/snippet.js";></script>
<title>Scaling Solr: From Desktop to Cloud Scale - Apache Solr</title>
<meta name="keywords"
content="apache, apache lucene, apache solr, solr, lucene,
search, information retrieval, spell checking, faceting,
inverted index, open source"/>
<meta property="og:type" content="website" />
- <meta property="og:url" content="https://solr.apache.org/security.html"/>
- <meta property="og:title" content="Solr™ Security"/>
- <meta property="og:description" content="Report a New Vulnerability¶ The
Solr PMC greatly appreciates responsible disclosure of new security
vulnerabilities found in Solr..."/>
+ <meta property="og:url"
content="https://solr.apache.org/blogposts/scaling-solr-mental-model.html"/>
+ <meta property="og:title" content="Scaling Solr: From Desktop to Cloud
Scale"/>
+ <meta property="og:description" content="Scaling Solr: From Desktop to
Cloud Scale¶ Opinion piece derived from Eric's talk at Community over Code
Denver. The complete post..."/>
<meta property="og:image"
content="https://solr.apache.org/theme/images/solr_og_image.png?v=033782dc"/>
<meta property="og:image:secure_url"
content="https://solr.apache.org/theme/solr/solr_og_image.png?v=033782dc"/>
<link rel="icon" href="/theme/images/favicon.ico" type="image/x-icon">
<link rel="shortcut icon" href="/theme/images/favicon.ico"
type="image/x-icon">
-<link rel="alternate" type="application/atom+xml" title="Solr security
announce feed" href="/feeds/solr/security.atom.xml" /><!-- Matomo -->
+<!-- Matomo -->
<script>
var _paq = window._paq = window._paq || [];
/* tracker methods like "setCustomDimension" should be called before
"trackPageView" */
@@ -69,7 +69,7 @@
</script>
<!-- End Matomo Code --> </head>
- <body class="page nav-security" x-ng-app-root="/solr" x-ng-app="page"
x-ng-controller="page.controllers.main">
+ <body class="page " x-ng-app="page" x-ng-controller="page.controllers.main">
<div class="contain-to-grid">
<div class="header-section">
<nav class="top-bar" data-topbar role="navigation">
@@ -128,101 +128,10 @@
<div class="header-fill"></div>
<div class="container">
-<style>.container { padding-top: 0; }</style><div class="sub-nav-container">
- <div class="row sub-nav-border anchor-top">
- <div class="small-12 text-center columns">
- <dl class="sub-nav">
-<dd><a href="/security.html" class="selected">Security</a></dd>
-<dd><a href="/security-reporting.html">Reporting Procedure</a></dd>
-<dd><a href="/security-dependency-cves.html">CVE Status for
Dependencies</a></dd> </dl>
- </div>
- </div>
-</div>
<div class="row">
-<div class="small-12 columns">
- <h1 id="solr-security">Solr<sup>™</sup> Security<a class="headerlink"
href="#solr-security" title="Permanent link">¶</a></h1>
- <h2 id="report-a-new-vulnerability">Report a New Vulnerability<a
class="headerlink" href="#report-a-new-vulnerability" title="Permanent
link">¶</a></h2>
-<p>The Solr PMC greatly appreciates responsible disclosure of new security
vulnerabilities found in Solr itself
-or demonstrating exploitation via a dependency.
-<strong>It is important not to publish a previously unknown exploit</strong>,
or exploit demonstration code, on public
-mailing lists or issue trackers before coordinating with the PMC.</p>
-<p>See the <a href="security-reporting.html">vulnerability reporting
procedure</a> for the full reporting rules,
-the workflow diagram, and what to expect after you report.</p>
-<h2 id="cves-in-dependencies-detected-by-scanners">CVEs in Dependencies
Detected by Scanners<a class="headerlink"
href="#cves-in-dependencies-detected-by-scanners" title="Permanent
link">¶</a></h2>
-<p>Every CVE detected by a scanner is by definition already public knowledge.
-Before contacting the security team about a dependency CVE, please:</p>
-<ol>
-<li>Check the <a href="security-dependency-cves.html">dependency CVE status
page</a> to see if the CVE has already
- been assessed as not exploitable in Solr.</li>
-<li>Search the <a
href="https://lists.apache.org/[email protected]";>Solr users
mailing list archive</a>
- to see if the CVE has been discussed.</li>
-<li>If nothing is found, <a
href="https://solr.apache.org/community.html#mailing-lists-chat";>subscribe to
the users list</a>
- and ask there.</li>
-</ol>
-<h4 id="dos-and-donts">Dos and Don'ts<a class="headerlink"
href="#dos-and-donts" title="Permanent link">¶</a></h4>
-<ul>
-<li><strong>DO</strong> discuss dependency upgrade needs on the users mailing
list</li>
-<li><strong>DO</strong> search Jira for the CVE number before opening a new
issue</li>
-<li><strong>DO</strong> open a focused Jira issue with a PR to upgrade a
<em>single specific</em> dependency</li>
-<li><strong>DO</strong> look into automating CVE triage with <a
href="security-dependency-cves.html">VEX</a> and share your experience</li>
-<li><strong>DO NOT</strong> email the security address with scanner reports —
they will not be processed</li>
-<li><strong>DO NOT</strong> paste scan output into Jira or attach reports —
link the CVE instead</li>
-</ul>
-<h4 id="use-of-jira">Use of Jira<a class="headerlink" href="#use-of-jira"
title="Permanent link">¶</a></h4>
-<p>Jira is for discussing specific development modifications. Any Jira that
contains only scan report
-output, or references multiple dependencies at the same time is likely to be
ignored or closed.
-The large number of reports about already-known issues is a serious drag on
our volunteer time —
-<strong>please search Jira</strong> before opening a new issue.</p>
-
- <h2 id="recent-cve-disclosures-for-apache-solr">Recent CVE Disclosures for
Apache Solr
- <a class="headerlink" href="#recent-cve-disclosures-for-apache-solr"
title="Permanent link">¶</a>
- </h2>
- <p>The five most recent security advisories.</p>
-
- <table>
- <tr>
- <th width="130">CVE#</th>
- <th width="95">Date</th>
- <th>Announcement</th>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-22022";>CVE-2026-22022</a></td>
- <td>2026-01-20</td>
- <td><a
href="/security-news.html#cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin">Unauthorized
bypass of certain "predefined permission" rules in the
RuleBasedAuthorizationPlugin</a></td>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-22444";>CVE-2026-22444</a></td>
- <td>2026-01-20</td>
- <td><a
href="/security-news.html#cve-2026-22444-insufficient-file-access-checking-in-standalone-core-creation-requests">Insufficient
file-access checking in standalone core-creation requests</a></td>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66516";>CVE-2025-66516</a></td>
- <td>2025-12-09</td>
- <td><a
href="/security-news.html#cve-2025-66516-apache-solr-extraction-module-vulnerable-to-xxe-attacks-via-xfa-content-in-pdfs">Apache
Solr extraction module vulnerable to XXE attacks via XFA content in
PDFs</a></td>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-52012";>CVE-2024-52012</a></td>
- <td>2025-01-26</td>
- <td><a
href="/security-news.html#cve-2024-52012-apache-solr-configset-upload-on-windows-allows-arbitrary-path-write-access">Apache
Solr: Configset upload on Windows allows arbitrary path write-access</a></td>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-24814";>CVE-2025-24814</a></td>
- <td>2025-01-26</td>
- <td><a
href="/security-news.html#cve-2025-24814-apache-solr-core-creation-with-trusted-configset-can-use-arbitrary-untrusted-files">Apache
Solr: Core-creation with "trusted" configset can use arbitrary untrusted
files</a></td>
- </tr>
- </table>
- <p><a href="/security-news.html">See full security news history →</a></p>
-
- <h2 id="more-information">More Information <a class="headerlink"
href="#more-information" title="Permanent link">¶</a></h2>
- <ul>
- <li><a href="/security-news.html">Full security news history</a> — all
past CVE advisories</li>
- <li><a href="/security-dependency-cves.html">Dependency CVE status and VEX
download</a> — non-exploitable CVEs in dependencies</li>
- <li><a href="/security-reporting.html">Vulnerability reporting
procedure</a> — submission rules, workflow, and PMC email templates</li>
- <li><a href="https://www.apache.org/security/";>ASF security resources</a>
— Apache-wide security guidance</li>
- </ul>
-
-</div>
- </div>
+<h1 id="scaling-solr-from-desktop-to-cloud-scale">Scaling Solr: From Desktop
to Cloud Scale<a class="headerlink"
href="#scaling-solr-from-desktop-to-cloud-scale" title="Permanent
link">¶</a></h1>
+<p>Opinion piece derived from Eric's talk at Community over Code Denver.</p>
+<p>The complete post can be read here: <a
href="https://dep4b.hashnode.dev/scaling-solr-from-desktop-to-cloud-scale";>Scaling
Solr: From Desktop to Cloud Scale</a></p> </div>
</div>
<footer>
<div class="row">
diff --git a/output/security.html
b/output/blogposts/solr-lucene-migration-correctness.html
similarity index 60%
copy from output/security.html
copy to output/blogposts/solr-lucene-migration-correctness.html
index edf59fb71..839f264b8 100644
--- a/output/security.html
+++ b/output/blogposts/solr-lucene-migration-correctness.html
@@ -37,21 +37,21 @@
<script
src="/theme/javascript/lib/foundation/foundation.min.js?v=033782dc"></script>
<script
src="/theme/javascript/lib/jquery.smooth-scroll.min.js?v=033782dc"></script>
<script src="/theme/javascript/main.js?v=033782dc"></script>
-<script src="https://www.apachecon.com/event-images/snippet.js";></script>
<title>Solr™ Security - Apache Solr</title>
+<script src="https://www.apachecon.com/event-images/snippet.js";></script>
<title>Validating Ranking Correctness During Solr/Lucene Migrations - Apache
Solr</title>
<meta name="keywords"
content="apache, apache lucene, apache solr, solr, lucene,
search, information retrieval, spell checking, faceting,
inverted index, open source"/>
<meta property="og:type" content="website" />
- <meta property="og:url" content="https://solr.apache.org/security.html"/>
- <meta property="og:title" content="Solr™ Security"/>
- <meta property="og:description" content="Report a New Vulnerability¶ The
Solr PMC greatly appreciates responsible disclosure of new security
vulnerabilities found in Solr..."/>
+ <meta property="og:url"
content="https://solr.apache.org/blogposts/solr-lucene-migration-correctness.html"/>
+ <meta property="og:title" content="Validating Ranking Correctness During
Solr/Lucene Migrations"/>
+ <meta property="og:description" content="Validating Ranking Correctness
During Solr/Lucene Migrations¶ Major Solr/Lucene upgrades can introduce subtle
ranking behavior..."/>
<meta property="og:image"
content="https://solr.apache.org/theme/images/solr_og_image.png?v=033782dc"/>
<meta property="og:image:secure_url"
content="https://solr.apache.org/theme/solr/solr_og_image.png?v=033782dc"/>
<link rel="icon" href="/theme/images/favicon.ico" type="image/x-icon">
<link rel="shortcut icon" href="/theme/images/favicon.ico"
type="image/x-icon">
-<link rel="alternate" type="application/atom+xml" title="Solr security
announce feed" href="/feeds/solr/security.atom.xml" /><!-- Matomo -->
+<!-- Matomo -->
<script>
var _paq = window._paq = window._paq || [];
/* tracker methods like "setCustomDimension" should be called before
"trackPageView" */
@@ -69,7 +69,7 @@
</script>
<!-- End Matomo Code --> </head>
- <body class="page nav-security" x-ng-app-root="/solr" x-ng-app="page"
x-ng-controller="page.controllers.main">
+ <body class="page " x-ng-app="page" x-ng-controller="page.controllers.main">
<div class="contain-to-grid">
<div class="header-section">
<nav class="top-bar" data-topbar role="navigation">
@@ -128,101 +128,10 @@
<div class="header-fill"></div>
<div class="container">
-<style>.container { padding-top: 0; }</style><div class="sub-nav-container">
- <div class="row sub-nav-border anchor-top">
- <div class="small-12 text-center columns">
- <dl class="sub-nav">
-<dd><a href="/security.html" class="selected">Security</a></dd>
-<dd><a href="/security-reporting.html">Reporting Procedure</a></dd>
-<dd><a href="/security-dependency-cves.html">CVE Status for
Dependencies</a></dd> </dl>
- </div>
- </div>
-</div>
<div class="row">
-<div class="small-12 columns">
- <h1 id="solr-security">Solr<sup>™</sup> Security<a class="headerlink"
href="#solr-security" title="Permanent link">¶</a></h1>
- <h2 id="report-a-new-vulnerability">Report a New Vulnerability<a
class="headerlink" href="#report-a-new-vulnerability" title="Permanent
link">¶</a></h2>
-<p>The Solr PMC greatly appreciates responsible disclosure of new security
vulnerabilities found in Solr itself
-or demonstrating exploitation via a dependency.
-<strong>It is important not to publish a previously unknown exploit</strong>,
or exploit demonstration code, on public
-mailing lists or issue trackers before coordinating with the PMC.</p>
-<p>See the <a href="security-reporting.html">vulnerability reporting
procedure</a> for the full reporting rules,
-the workflow diagram, and what to expect after you report.</p>
-<h2 id="cves-in-dependencies-detected-by-scanners">CVEs in Dependencies
Detected by Scanners<a class="headerlink"
href="#cves-in-dependencies-detected-by-scanners" title="Permanent
link">¶</a></h2>
-<p>Every CVE detected by a scanner is by definition already public knowledge.
-Before contacting the security team about a dependency CVE, please:</p>
-<ol>
-<li>Check the <a href="security-dependency-cves.html">dependency CVE status
page</a> to see if the CVE has already
- been assessed as not exploitable in Solr.</li>
-<li>Search the <a
href="https://lists.apache.org/[email protected]";>Solr users
mailing list archive</a>
- to see if the CVE has been discussed.</li>
-<li>If nothing is found, <a
href="https://solr.apache.org/community.html#mailing-lists-chat";>subscribe to
the users list</a>
- and ask there.</li>
-</ol>
-<h4 id="dos-and-donts">Dos and Don'ts<a class="headerlink"
href="#dos-and-donts" title="Permanent link">¶</a></h4>
-<ul>
-<li><strong>DO</strong> discuss dependency upgrade needs on the users mailing
list</li>
-<li><strong>DO</strong> search Jira for the CVE number before opening a new
issue</li>
-<li><strong>DO</strong> open a focused Jira issue with a PR to upgrade a
<em>single specific</em> dependency</li>
-<li><strong>DO</strong> look into automating CVE triage with <a
href="security-dependency-cves.html">VEX</a> and share your experience</li>
-<li><strong>DO NOT</strong> email the security address with scanner reports —
they will not be processed</li>
-<li><strong>DO NOT</strong> paste scan output into Jira or attach reports —
link the CVE instead</li>
-</ul>
-<h4 id="use-of-jira">Use of Jira<a class="headerlink" href="#use-of-jira"
title="Permanent link">¶</a></h4>
-<p>Jira is for discussing specific development modifications. Any Jira that
contains only scan report
-output, or references multiple dependencies at the same time is likely to be
ignored or closed.
-The large number of reports about already-known issues is a serious drag on
our volunteer time —
-<strong>please search Jira</strong> before opening a new issue.</p>
-
- <h2 id="recent-cve-disclosures-for-apache-solr">Recent CVE Disclosures for
Apache Solr
- <a class="headerlink" href="#recent-cve-disclosures-for-apache-solr"
title="Permanent link">¶</a>
- </h2>
- <p>The five most recent security advisories.</p>
-
- <table>
- <tr>
- <th width="130">CVE#</th>
- <th width="95">Date</th>
- <th>Announcement</th>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-22022";>CVE-2026-22022</a></td>
- <td>2026-01-20</td>
- <td><a
href="/security-news.html#cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin">Unauthorized
bypass of certain "predefined permission" rules in the
RuleBasedAuthorizationPlugin</a></td>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-22444";>CVE-2026-22444</a></td>
- <td>2026-01-20</td>
- <td><a
href="/security-news.html#cve-2026-22444-insufficient-file-access-checking-in-standalone-core-creation-requests">Insufficient
file-access checking in standalone core-creation requests</a></td>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66516";>CVE-2025-66516</a></td>
- <td>2025-12-09</td>
- <td><a
href="/security-news.html#cve-2025-66516-apache-solr-extraction-module-vulnerable-to-xxe-attacks-via-xfa-content-in-pdfs">Apache
Solr extraction module vulnerable to XXE attacks via XFA content in
PDFs</a></td>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-52012";>CVE-2024-52012</a></td>
- <td>2025-01-26</td>
- <td><a
href="/security-news.html#cve-2024-52012-apache-solr-configset-upload-on-windows-allows-arbitrary-path-write-access">Apache
Solr: Configset upload on Windows allows arbitrary path write-access</a></td>
- </tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-24814";>CVE-2025-24814</a></td>
- <td>2025-01-26</td>
- <td><a
href="/security-news.html#cve-2025-24814-apache-solr-core-creation-with-trusted-configset-can-use-arbitrary-untrusted-files">Apache
Solr: Core-creation with "trusted" configset can use arbitrary untrusted
files</a></td>
- </tr>
- </table>
- <p><a href="/security-news.html">See full security news history →</a></p>
-
- <h2 id="more-information">More Information <a class="headerlink"
href="#more-information" title="Permanent link">¶</a></h2>
- <ul>
- <li><a href="/security-news.html">Full security news history</a> — all
past CVE advisories</li>
- <li><a href="/security-dependency-cves.html">Dependency CVE status and VEX
download</a> — non-exploitable CVEs in dependencies</li>
- <li><a href="/security-reporting.html">Vulnerability reporting
procedure</a> — submission rules, workflow, and PMC email templates</li>
- <li><a href="https://www.apache.org/security/";>ASF security resources</a>
— Apache-wide security guidance</li>
- </ul>
-
-</div>
- </div>
+<h1
id="validating-ranking-correctness-during-solrlucene-migrations">Validating
Ranking Correctness During Solr/Lucene Migrations<a class="headerlink"
href="#validating-ranking-correctness-during-solrlucene-migrations"
title="Permanent link">¶</a></h1>
+<p>Major Solr/Lucene upgrades can introduce subtle ranking behavior changes
even when functional tests continue to pass. This article discusses a practical
side-by-side validation approach for detecting candidate-set changes, rank
deltas, score distribution drift, and latency differences during migration
testing.</p>
+<p>The complete post can be read here: <a
href="https://dzone.com/articles/solr5-to-solr8-migration-ads-system";>Validating
Ranking Correctness During Solr/Lucene Migrations</a>.</p> </div>
</div>
<footer>
<div class="row">
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index b344210f1..93208766c 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,48 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-03-03T00:00:00+00:00</updated><entry><title>Apache
Solr™ 10.0.0 available</title><link href="/apache-solrtm-1000-available.html"
rel="alternate"/><published>2026-03-03T00:00:00+00:00</published><updated>2026-03-03T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-03-03:/apache-solrtm-1 [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-05-19T00:00:00+00:00</updated><entry><title>JWT
Authentication: blockUnknown default allows unauthenticated access contrary to
documentation</title><link
href="/jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation.html"
rel="alternate"/><published>2026-05-19T00:00:00+00:00</publi [...]
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration
parameter <code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr
…</p></summary><content
type="html"><p><strong>Severity</strong>
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration
parameter <code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr
9.0, but the code default has always
+been <code>false</code>. Operators who did not explicitly set this
parameter may therefore have been
+unknowingly accepting anonymous requests.</p>
+<p><strong>Am I Affected?</strong></p>
+<p>You may be affected if <strong>all</strong> of the
following are true:</p>
+<ol>
+<li>You use the JWT Authentication Plugin
(<code>solr.JWTAuthPlugin</code>) in
<code>security.json</code></li>
+<li>Your intention is to block all unauthenticated requests</li>
+<li>Your <code>security.json</code> does
<strong>not</strong> explicitly set
<code>blockUnknown</code> to
<code>true</code></li>
+</ol>
+<p>You are <strong>not</strong> affected if any of the
following applies:</p>
+<ul>
+<li><code>blockUnknown</code> is explicitly set to
<code>true</code> in
<code>security.json</code></li>
+<li>An AuthorizationPlugin (e.g.
<code>RuleBasedAuthorizationPlugin</code>) independently denies
access to unauthenticated users</li>
+</ul>
+<p><strong>Mitigation</strong></p>
+<p>Check the <code>authentication</code> section of your
<code>security.json</code>. If
<code>blockUnknown</code> is absent, set it explicitly to
<code>true</code>.</p>
+<p><strong>Fix</strong></p>
+<p>Upcoming Solr 9.11 and 10.1 releases will change the code default of
<code>blockUnknown</code> to <code>true</code>.
+Explicitly setting <code>blockUnknown</code> to
<code>true</code> in a current release is sufficient; upgrading is
not required.</p>
+<p><strong>References</strong></p>
+<ul>
+<li><a
href="https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html">JWT
Authentication Plugin documentation</a></li>
+</ul></content><category
term="solr/security"/></entry><entry><title>Apache Solr™ 10.0.0
available</title><link href="/apache-solrtm-1000-available.html"
rel="alternate"/><published>2026-03-03T00:00:00+00:00</published><updated>2026-03-03T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-03-03:/apache-solrtm-1000-available.html</id><summary
type="html"><p>The Solr PMC is pleased to announce the release of Apache
Solr 10.0.0.</p>
<p>Apache Solr is the blazing-fast, open source, multi-modal search
platform built on the full-text, vector, and geospatial search capabilities of
Apache Lucene. Its major features include powerful full-text search, vector
search, hit highlighting, faceted search …</p></summary><content
type="html"><p>The Solr PMC is pleased to announce the release of Apache
Solr 10.0.0.</p>
<p>Apache Solr is the blazing-fast, open source, multi-modal search
platform built on the full-text, vector, and geospatial search capabilities of
Apache Lucene. Its major features include powerful full-text search, vector
search, hit highlighting, faceted search and analytics, rich document parsing,
geospatial search, extensive REST APIs as well as parallel SQL. Solr is
enterprise grade, secure and highly scalable, providing fault tolerant
distributed search and indexing, and powe [...]
<p>Solr 10.0.0 is available for immediate download at:</p>
@@ -2302,27 +2345,4 @@ features of many of the world's largest internet
sites.</p>
<ul>
<li>Ability to disable configset upload via
-Dconfigset.upload.enabled=false startup parameter</li>
<li>Referal to external resources in various config files now
disallowed</li>
-</ul></content><category term="solr/news"/></entry><entry><title>Apache
Solr™ 7.4.0 available</title><link href="/"
rel="alternate"/><published>2018-06-27T00:00:00+00:00</published><updated>2018-06-27T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2018-06-27:/</id><summary
type="html"><p>The Lucene PMC is pleased to announce the release of
Apache Solr 7.4.0</p>
-<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the
-Apache Lucene project. Its major features include powerful full-text search,
-hit highlighting, faceted search and analytics, rich document parsing,
-geospatial search, extensive …</p></summary><content
type="html"><p>The Lucene PMC is pleased to announce the release of
Apache Solr 7.4.0</p>
-<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the
-Apache Lucene project. Its major features include powerful full-text search,
-hit highlighting, faceted search and analytics, rich document parsing,
-geospatial search, extensive REST APIs as well as parallel SQL. Solr is
-enterprise grade, secure and highly scalable, providing fault tolerant
-distributed search and indexing, and powers the search and navigation
-features of many of the world's largest internet sites.</p>
-<p>Solr 7.4.0 is available for immediate download at:</p>
-<p><a
href="https://solr.apache.org/downloads.html">https://solr.apache.org/downloads.html</a></p>
-<p>Please read CHANGES.txt for a full list of new features and
changes:</p>
-<p><a
href="https://solr.apache.org/7_4_0/changes/Changes.html">https://solr.apache.org/7_4_0/changes/Changes.html</a></p>
-<h3 id="solr-740-release-highlights">Solr 7.4.0 Release Highlights:<a
class="headerlink" href="#solr-740-release-highlights" title="Permanent
link">&para;</a></h3>
-<ul>
-<li>A new 'relatedness()' aggregate function for JSON Faceting to enable
building Semantic Knowledge Graphs.</li>
-<li>Added the TaggerRequestHandler (AKA SolrTextTagger) for tagging
text. It's used as a component of NER/ERD systems including
query-understanding.</li>
-<li>The "Auto Scaling" feature area has been added to and enhanced a
lot.</li>
-<li>The "Streaming Expressions" feature area has been added to and
enhanced a lot.</li>
-<li>Upgraded from Log4j 1.x to 2.x. Solr continues to log via
SLF4J.</li>
</ul></content><category term="solr/news"/></entry></feed>
\ No newline at end of file
diff --git a/output/feeds/solr/security.atom.xml
b/output/feeds/solr/security.atom.xml
index 981c38784..2bbb65ce9 100644
--- a/output/feeds/solr/security.atom.xml
+++ b/output/feeds/solr/security.atom.xml
@@ -1,5 +1,48 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/security</title><link href="/" rel="alternate"/><link
href="/feeds/solr/security.atom.xml"
rel="self"/><id>/</id><updated>2026-01-20T00:00:00+00:00</updated><entry><title>CVE-2026-22022:
Unauthorized bypass of certain "predefined permission" rules in the
RuleBasedAuthorizationPlugin</title><link
href="/cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin.html"
rel= [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/security</title><link href="/" rel="alternate"/><link
href="/feeds/solr/security.atom.xml"
rel="self"/><id>/</id><updated>2026-05-19T00:00:00+00:00</updated><entry><title>JWT
Authentication: blockUnknown default allows unauthenticated access contrary to
documentation</title><link
href="/jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation.html"
rel="alternate"/><published>2026-0 [...]
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration
parameter <code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr
…</p></summary><content
type="html"><p><strong>Severity</strong>
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration
parameter <code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr
9.0, but the code default has always
+been <code>false</code>. Operators who did not explicitly set this
parameter may therefore have been
+unknowingly accepting anonymous requests.</p>
+<p><strong>Am I Affected?</strong></p>
+<p>You may be affected if <strong>all</strong> of the
following are true:</p>
+<ol>
+<li>You use the JWT Authentication Plugin
(<code>solr.JWTAuthPlugin</code>) in
<code>security.json</code></li>
+<li>Your intention is to block all unauthenticated requests</li>
+<li>Your <code>security.json</code> does
<strong>not</strong> explicitly set
<code>blockUnknown</code> to
<code>true</code></li>
+</ol>
+<p>You are <strong>not</strong> affected if any of the
following applies:</p>
+<ul>
+<li><code>blockUnknown</code> is explicitly set to
<code>true</code> in
<code>security.json</code></li>
+<li>An AuthorizationPlugin (e.g.
<code>RuleBasedAuthorizationPlugin</code>) independently denies
access to unauthenticated users</li>
+</ul>
+<p><strong>Mitigation</strong></p>
+<p>Check the <code>authentication</code> section of your
<code>security.json</code>. If
<code>blockUnknown</code> is absent, set it explicitly to
<code>true</code>.</p>
+<p><strong>Fix</strong></p>
+<p>Upcoming Solr 9.11 and 10.1 releases will change the code default of
<code>blockUnknown</code> to <code>true</code>.
+Explicitly setting <code>blockUnknown</code> to
<code>true</code> in a current release is sufficient; upgrading is
not required.</p>
+<p><strong>References</strong></p>
+<ul>
+<li><a
href="https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html">JWT
Authentication Plugin documentation</a></li>
+</ul></content><category
term="solr/security"/></entry><entry><title>CVE-2026-22022: Unauthorized bypass
of certain "predefined permission" rules in the
RuleBasedAuthorizationPlugin</title><link
href="/cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin.html"
rel="alternate"/><published>2026-01-20T00:00:00+00:00</published><updated>2026-01-20T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2 [...]
moderate</p>
<p><strong>Description</strong>
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule
Based Authorization Plugin" are vulnerable to allowing unauthorized access to
certain Solr APIs, due to insufficiently strict input validation in those
components. Only deployments that meet all of the following criteria
…</p></summary><content
type="html"><p><strong>Severity</strong>
diff --git a/output/index.html b/output/index.html
index 9757b5c41..95cee0951 100644
--- a/output/index.html
+++ b/output/index.html
@@ -127,7 +127,7 @@
</div>
<div class="header-fill"></div>
-<section class="security" latest-date="2026-01-20">
+<section class="security" latest-date="2026-05-19">
<div class="row">
<div class="large-12 columns text-center">
<h2><a href="security.html">⚠ There are recent security
announcements. Read more on the Security page.</a></h2>
diff --git a/output/news.html b/output/news.html
index b424deeae..97e8a6590 100644
--- a/output/news.html
+++ b/output/news.html
@@ -145,6 +145,43 @@
<h1 id="solr-news">Solr<sup>™</sup> Announcements<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
<p>You may also read these news as ATOM feeds: <a
href="/feeds/solr/news.atom.xml">Announcements</a>, <a
href="/feeds/solr/security.atom.xml">Security Announcements</a>..</p>
+ <h2
id="jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">19
May 2026, JWT Authentication: blockUnknown default allows unauthenticated
access contrary to documentation
+ <a class="headerlink"
href="#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation"
title="Permanent link">¶</a>
+ </h2>
+ <p><strong>Severity</strong>
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration parameter
<code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr 9.0, but the
code default has always
+been <code>false</code>. Operators who did not explicitly set this parameter
may therefore have been
+unknowingly accepting anonymous requests.</p>
+<p><strong>Am I Affected?</strong></p>
+<p>You may be affected if <strong>all</strong> of the following are true:</p>
+<ol>
+<li>You use the JWT Authentication Plugin (<code>solr.JWTAuthPlugin</code>) in
<code>security.json</code></li>
+<li>Your intention is to block all unauthenticated requests</li>
+<li>Your <code>security.json</code> does <strong>not</strong> explicitly set
<code>blockUnknown</code> to <code>true</code></li>
+</ol>
+<p>You are <strong>not</strong> affected if any of the following applies:</p>
+<ul>
+<li><code>blockUnknown</code> is explicitly set to <code>true</code> in
<code>security.json</code></li>
+<li>An AuthorizationPlugin (e.g. <code>RuleBasedAuthorizationPlugin</code>)
independently denies access to unauthenticated users</li>
+</ul>
+<p><strong>Mitigation</strong></p>
+<p>Check the <code>authentication</code> section of your
<code>security.json</code>. If <code>blockUnknown</code> is absent, set it
explicitly to <code>true</code>.</p>
+<p><strong>Fix</strong></p>
+<p>Upcoming Solr 9.11 and 10.1 releases will change the code default of
<code>blockUnknown</code> to <code>true</code>.
+Explicitly setting <code>blockUnknown</code> to <code>true</code> in a current
release is sufficient; upgrading is not required.</p>
+<p><strong>References</strong></p>
+<ul>
+<li><a
href="https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html";>JWT
Authentication Plugin documentation</a></li>
+</ul>
<h2 id="apache-solrtm-1000-available">3 March 2026, Apache Solr™ 10.0.0
available
<a class="headerlink" href="#apache-solrtm-1000-available"
title="Permanent link">¶</a>
</h2>
diff --git a/output/operator/index.html b/output/operator/index.html
index 883d6ef2a..71030db5b 100644
--- a/output/operator/index.html
+++ b/output/operator/index.html
@@ -122,7 +122,7 @@
</div>
<div class="header-fill"></div>
-<section class="security" latest-date="2026-01-20">
+<section class="security" latest-date="2026-05-19">
<div class="row">
<div class="large-12 columns text-center">
<h2><a href="/security.html">⚠ There are recent security
announcements. Read more on the Solr Security page.</a></h2>
diff --git a/output/posts.html b/output/posts.html
index 79f42cdd2..044f2646d 100644
--- a/output/posts.html
+++ b/output/posts.html
@@ -152,6 +152,28 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2
id="jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation"
class="post-item-title">
+ <a
href="/news.html#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">JWT
Authentication: blockUnknown default allows unauthenticated access contrary to
documentation</a>
+ <a class="headerlink"
href="#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>Security:</strong>
+ 19 May 2026
+ </h5>
+ <p>Severity moderate Versions Affected Apache Solr 9.0.0 through 9.10.1
Apache Solr 10.0.0 Description The Apache Solr JWT Authentication Plugin has a
configuration parameter blockUnknown that controls whether anonymous
(unauthenticated) requests are blocked. The Reference Guide has documented this
as defaulting to true since Solr …</p>
+ <div class="read-more">
+ <a
href="/news.html#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">Read
full article on news page →</a>
+ </div>
+ <hr/>
+ <h2 id="solr-lucene-migration-correctness" class="post-item-title">
+ <a href="blogposts/solr-lucene-migration-correctness.html">Validating
Ranking Correctness During Solr/Lucene Migrations</a>
+ <a class="headerlink" href="#solr-lucene-migration-correctness"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ 2 May 2026
+ </h5>
+ <p>A practical article on detecting ranking behavior drift during major
Solr/Lucene upgrades using side-by-side validation of candidate overlap, rank
deltas, score distribution drift, and latency behavior. Written by Parveen
Saini.</p>
+ <hr/>
<h2 id="apache-solrtm-1000-available" class="post-item-title">
<a href="/news.html#apache-solrtm-1000-available">Apache Solr™ 10.0.0
available</a>
<a class="headerlink" href="#apache-solrtm-1000-available"
title="Permanent link">¶</a>
@@ -322,6 +344,15 @@
</h5>
<p>Let's explore whether to index a field in Apache Solr as a string or
integer for optimal filter query performance. Written by Ilaria Petreti,
Information Retrieval/Machine Learning Engineer at Sease.</p>
<hr/>
+ <h2 id="scaling-solr-mental-model" class="post-item-title">
+ <a href="blogposts/scaling-solr-mental-model.html">Scaling Solr: From
Desktop to Cloud Scale</a>
+ <a class="headerlink" href="#scaling-solr-mental-model" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ 9 November 2024
+ </h5>
+ <p>This blog post is a opinion piece on how to make Solr deployments
scale easily from small to massive. Written by Eric Pugh.</p>
+ <hr/>
<h2 id="solr-8-reaches-end-of-life" class="post-item-title">
<a href="/news.html#solr-8-reaches-end-of-life">Solr 8 reaches
End-Of-Life</a>
<a class="headerlink" href="#solr-8-reaches-end-of-life"
title="Permanent link">¶</a>
@@ -361,37 +392,6 @@
<a
href="/news.html#cve-2024-45217-apache-solr-configsets-created-during-a-backup-restore-command-are-trusted-implicitly">Read
full article on news page →</a>
</div>
<hr/>
- <h2 id="community-over-code-na-2024-birds-of-a-feather"
class="post-item-title">
- <a
href="blogposts/community-over-code-na-2024-birds-of-a-feather.html">Community
Over Code NA 2024 Apache Lucene/Solr Birds Of A Feather</a>
- <a class="headerlink"
href="#community-over-code-na-2024-birds-of-a-feather" title="Permanent
link">¶</a>
- </h2>
- <h5>
- 14 October 2024
- </h5>
- <p>This blog post is a summary of the Apache Lucene/Solr Birds of a
Feather from Community Over Code NA 2024 in Denver. Written by Eric Pugh and
Stefan Vodita.</p>
- <hr/>
- <h2 id="categorical-features-in-apache-solr-learning-to-rank"
class="post-item-title">
- <a
href="blogposts/categorical-features-in-apache-solr-learning-to-rank.html">Categorical
Features in Apache Solr Learning to Rank</a>
- <a class="headerlink"
href="#categorical-features-in-apache-solr-learning-to-rank" title="Permanent
link">¶</a>
- </h2>
- <h5>
- 9 October 2024
- </h5>
- <p>Let's see the available learning to rank Apache Solr features with a
focus on categorical features and how to manage them. Written by Anna Ruggero,
R&D Software Engineer at Sease.</p>
- <hr/>
- <h2 id="apache-solrtm-8114-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-8114-available">Apache Solr™ 8.11.4
available</a>
- <a class="headerlink" href="#apache-solrtm-8114-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 24 September 2024
- </h5>
- <p>The Lucene and Solr PMCs are pleased to announce the release of
Apache Solr 8.11.4. Solr is the blazing-fast, open source, multi-modal search
platform built on Apache Lucene. It powers full-text, analytics, and geospatial
search at many of the world's largest organizations. Other major features
include Kubernetes and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-8114-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<span class="pagination-info">
diff --git a/output/posts2.html b/output/posts2.html
index 8630f568d..30bf123c9 100644
--- a/output/posts2.html
+++ b/output/posts2.html
@@ -152,6 +152,37 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="community-over-code-na-2024-birds-of-a-feather"
class="post-item-title">
+ <a
href="blogposts/community-over-code-na-2024-birds-of-a-feather.html">Community
Over Code NA 2024 Apache Lucene/Solr Birds Of A Feather</a>
+ <a class="headerlink"
href="#community-over-code-na-2024-birds-of-a-feather" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ 14 October 2024
+ </h5>
+ <p>This blog post is a summary of the Apache Lucene/Solr Birds of a
Feather from Community Over Code NA 2024 in Denver. Written by Eric Pugh and
Stefan Vodita.</p>
+ <hr/>
+ <h2 id="categorical-features-in-apache-solr-learning-to-rank"
class="post-item-title">
+ <a
href="blogposts/categorical-features-in-apache-solr-learning-to-rank.html">Categorical
Features in Apache Solr Learning to Rank</a>
+ <a class="headerlink"
href="#categorical-features-in-apache-solr-learning-to-rank" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ 9 October 2024
+ </h5>
+ <p>Let's see the available learning to rank Apache Solr features with a
focus on categorical features and how to manage them. Written by Anna Ruggero,
R&D Software Engineer at Sease.</p>
+ <hr/>
+ <h2 id="apache-solrtm-8114-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-8114-available">Apache Solr™ 8.11.4
available</a>
+ <a class="headerlink" href="#apache-solrtm-8114-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 24 September 2024
+ </h5>
+ <p>The Lucene and Solr PMCs are pleased to announce the release of
Apache Solr 8.11.4. Solr is the blazing-fast, open source, multi-modal search
platform built on Apache Lucene. It powers full-text, analytics, and geospatial
search at many of the world's largest organizations. Other major features
include Kubernetes and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-8114-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="community-over-code-north-america-2024" class="post-item-title">
<a href="blogposts/community-over-code-north-america-2024.html">Join
us at Community Over Code North America 2024</a>
<a class="headerlink" href="#community-over-code-north-america-2024"
title="Permanent link">¶</a>
@@ -337,45 +368,6 @@
<a
href="/news.html#cve-2023-50292-apache-solr-schema-designer-blindly-trusts-all-configsets-possibly-leading-to-rce-by-unauthenticated-users">Read
full article on news page →</a>
</div>
<hr/>
- <h2
id="cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions"
class="post-item-title">
- <a
href="/news.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions">CVE-2023-50298:
Apache Solr can expose ZooKeeper credentials via Streaming Expressions</a>
- <a class="headerlink"
href="#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>Security:</strong>
- 8 February 2024
- </h5>
- <p>Severity: Low Versions Affected: Apache Solr 6.0.0 through 8.11.2
Apache Solr 9.0.0 before 9.4.1 Description: Exposure of Sensitive Information
to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache
Solr: from 6.0.0 through 8.11.2, from 9 …</p>
- <div class="read-more">
- <a
href="/news.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions">Read
full article on news page →</a>
- </div>
- <hr/>
- <h2
id="cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets"
class="post-item-title">
- <a
href="/news.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets">CVE-2023-50386:
Apache Solr: Backup/Restore APIs allow for deployment of executables in
malicious ConfigSets</a>
- <a class="headerlink"
href="#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>Security:</strong>
- 8 February 2024
- </h5>
- <p>Severity: Moderate Versions Affected: Apache Solr 6.0.0 through
8.11.2 Apache Solr 9.0.0 before 9.4.1 Description: Improper Control of
Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous
Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in
Apache Solr.This issue affects …</p>
- <div class="read-more">
- <a
href="/news.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets">Read
full article on news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solrtm-941-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-941-available">Apache Solr™ 9.4.1
available</a>
- <a class="headerlink" href="#apache-solrtm-941-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 18 January 2024
- </h5>
- <p>The Solr PMC is pleased to announce the release of Apache Solr 9.4.1.
Solr is the popular, blazing fast, open source NoSQL search platform from the
Apache Solr project. Its major features include powerful full-text search, hit
highlighting, faceted search, dynamic clustering, database integration, rich
document handling, and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-941-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts.html">← Previous</a>
diff --git a/output/posts3.html b/output/posts3.html
index ef239463e..676e11287 100644
--- a/output/posts3.html
+++ b/output/posts3.html
@@ -152,6 +152,45 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2
id="cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions"
class="post-item-title">
+ <a
href="/news.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions">CVE-2023-50298:
Apache Solr can expose ZooKeeper credentials via Streaming Expressions</a>
+ <a class="headerlink"
href="#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>Security:</strong>
+ 8 February 2024
+ </h5>
+ <p>Severity: Low Versions Affected: Apache Solr 6.0.0 through 8.11.2
Apache Solr 9.0.0 before 9.4.1 Description: Exposure of Sensitive Information
to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache
Solr: from 6.0.0 through 8.11.2, from 9 …</p>
+ <div class="read-more">
+ <a
href="/news.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions">Read
full article on news page →</a>
+ </div>
+ <hr/>
+ <h2
id="cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets"
class="post-item-title">
+ <a
href="/news.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets">CVE-2023-50386:
Apache Solr: Backup/Restore APIs allow for deployment of executables in
malicious ConfigSets</a>
+ <a class="headerlink"
href="#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>Security:</strong>
+ 8 February 2024
+ </h5>
+ <p>Severity: Moderate Versions Affected: Apache Solr 6.0.0 through
8.11.2 Apache Solr 9.0.0 before 9.4.1 Description: Improper Control of
Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous
Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in
Apache Solr.This issue affects …</p>
+ <div class="read-more">
+ <a
href="/news.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets">Read
full article on news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solrtm-941-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-941-available">Apache Solr™ 9.4.1
available</a>
+ <a class="headerlink" href="#apache-solrtm-941-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 18 January 2024
+ </h5>
+ <p>The Solr PMC is pleased to announce the release of Apache Solr 9.4.1.
Solr is the popular, blazing fast, open source NoSQL search platform from the
Apache Solr project. Its major features include powerful full-text search, hit
highlighting, faceted search, dynamic clustering, database integration, rich
document handling, and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-941-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2
id="cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables"
class="post-item-title">
<a
href="/news.html#cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables">CVE-2023-50290:
Apache Solr allows read access to host environment variables</a>
<a class="headerlink"
href="#cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables"
title="Permanent link">¶</a>
@@ -373,45 +412,6 @@
<a href="/news.html#apache-solrtm-8110-available">Read full article on
news page →</a>
</div>
<hr/>
- <h2 id="apache-solrtm-8101-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-8101-available">Apache Solr™ 8.10.1
available</a>
- <a class="headerlink" href="#apache-solrtm-8101-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 18 October 2021
- </h5>
- <p>The Solr PMC is pleased to announce the release of Apache Solr
8.10.1. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-8101-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solrtm-8100-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-8100-available">Apache Solr™ 8.10.0
available</a>
- <a class="headerlink" href="#apache-solrtm-8100-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 27 September 2021
- </h5>
- <p>The Solr PMC is pleased to announce the release of Apache Solr
8.10.0. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-8100-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solrtm-890-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-890-available">Apache Solr™ 8.9.0
available</a>
- <a class="headerlink" href="#apache-solrtm-890-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 16 June 2021
- </h5>
- <p>The Solr PMC is pleased to announce the release of Apache Solr 8.9.0.
Solr is the popular, blazing fast, open source NoSQL search platform from the
Apache Lucene project. Its major features include powerful full-text search,
hit highlighting, faceted search, dynamic clustering, database integration,
rich document handling, and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-890-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts2.html">← Previous</a>
diff --git a/output/posts4.html b/output/posts4.html
index b19d3ca89..ace8d651f 100644
--- a/output/posts4.html
+++ b/output/posts4.html
@@ -152,6 +152,45 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solrtm-8101-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-8101-available">Apache Solr™ 8.10.1
available</a>
+ <a class="headerlink" href="#apache-solrtm-8101-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 18 October 2021
+ </h5>
+ <p>The Solr PMC is pleased to announce the release of Apache Solr
8.10.1. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-8101-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solrtm-8100-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-8100-available">Apache Solr™ 8.10.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-8100-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 27 September 2021
+ </h5>
+ <p>The Solr PMC is pleased to announce the release of Apache Solr
8.10.0. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-8100-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solrtm-890-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-890-available">Apache Solr™ 8.9.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-890-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 16 June 2021
+ </h5>
+ <p>The Solr PMC is pleased to announce the release of Apache Solr 8.9.0.
Solr is the popular, blazing fast, open source NoSQL search platform from the
Apache Lucene project. Its major features include powerful full-text search,
hit highlighting, faceted search, dynamic clustering, database integration,
rich document handling, and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-890-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solrtm-882-available" class="post-item-title">
<a href="/news.html#apache-solrtm-882-available">Apache Solr™ 8.8.2
available</a>
<a class="headerlink" href="#apache-solrtm-882-available"
title="Permanent link">¶</a>
@@ -373,45 +412,6 @@
<a href="/news.html#apache-solrtm-851-available">Read full article on
news page →</a>
</div>
<hr/>
- <h2 id="apache-solrtm-850-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-850-available">Apache Solr™ 8.5.0
available</a>
- <a class="headerlink" href="#apache-solrtm-850-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 24 March 2020
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
8.5.0. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-850-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solrtm-841-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-841-available">Apache Solr™ 8.4.1
available</a>
- <a class="headerlink" href="#apache-solrtm-841-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 13 January 2020
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
8.4.1. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-841-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="cve-2019-17558-apache-solr-rce-through-velocityresponsewriter"
class="post-item-title">
- <a
href="/news.html#cve-2019-17558-apache-solr-rce-through-velocityresponsewriter">CVE-2019-17558:
Apache Solr RCE through VelocityResponseWriter</a>
- <a class="headerlink"
href="#cve-2019-17558-apache-solr-rce-through-velocityresponsewriter"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>Security:</strong>
- 30 December 2019
- </h5>
- <p>Severity: High Vendor: The Apache Software Foundation Versions
Affected: 5.0.0 to 8.3.1 Description: The affected versions are vulnerable to a
Remote Code Execution through the VelocityResponseWriter. A Velocity template
can be provided through Velocity templates in a configset velocity/ directory
or as a parameter. A user …</p>
- <div class="read-more">
- <a
href="/news.html#cve-2019-17558-apache-solr-rce-through-velocityresponsewriter">Read
full article on news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts3.html">← Previous</a>
diff --git a/output/posts5.html b/output/posts5.html
index 2378e410f..d6a4de336 100644
--- a/output/posts5.html
+++ b/output/posts5.html
@@ -152,6 +152,45 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solrtm-850-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-850-available">Apache Solr™ 8.5.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-850-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 24 March 2020
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
8.5.0. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-850-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solrtm-841-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-841-available">Apache Solr™ 8.4.1
available</a>
+ <a class="headerlink" href="#apache-solrtm-841-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 13 January 2020
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
8.4.1. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-841-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="cve-2019-17558-apache-solr-rce-through-velocityresponsewriter"
class="post-item-title">
+ <a
href="/news.html#cve-2019-17558-apache-solr-rce-through-velocityresponsewriter">CVE-2019-17558:
Apache Solr RCE through VelocityResponseWriter</a>
+ <a class="headerlink"
href="#cve-2019-17558-apache-solr-rce-through-velocityresponsewriter"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>Security:</strong>
+ 30 December 2019
+ </h5>
+ <p>Severity: High Vendor: The Apache Software Foundation Versions
Affected: 5.0.0 to 8.3.1 Description: The affected versions are vulnerable to a
Remote Code Execution through the VelocityResponseWriter. A Velocity template
can be provided through Velocity templates in a configset velocity/ directory
or as a parameter. A user …</p>
+ <div class="read-more">
+ <a
href="/news.html#cve-2019-17558-apache-solr-rce-through-velocityresponsewriter">Read
full article on news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solrtm-840-available" class="post-item-title">
<a href="/news.html#apache-solrtm-840-available">Apache Solr™ 8.4.0
available</a>
<a class="headerlink" href="#apache-solrtm-840-available"
title="Permanent link">¶</a>
@@ -373,45 +412,6 @@
<a href="/news.html#cve-2017-3164-ssrf-issue-in-apache-solr">Read full
article on news page →</a>
</div>
<hr/>
- <h2 id="apache-solrtm-770-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-770-available">Apache Solr™ 7.7.0
available</a>
- <a class="headerlink" href="#apache-solrtm-770-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 11 February 2019
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.7.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-770-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solrtm-760-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-760-available">Apache Solr™ 7.6.0
available</a>
- <a class="headerlink" href="#apache-solrtm-760-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 14 December 2018
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.6.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-760-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solrtm-750-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-750-available">Apache Solr™ 7.5.0
available</a>
- <a class="headerlink" href="#apache-solrtm-750-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 24 September 2018
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.5.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-750-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts4.html">← Previous</a>
diff --git a/output/posts6.html b/output/posts6.html
index 7add6ed89..1d1252c80 100644
--- a/output/posts6.html
+++ b/output/posts6.html
@@ -152,6 +152,45 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solrtm-770-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-770-available">Apache Solr™ 7.7.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-770-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 11 February 2019
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.7.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-770-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solrtm-760-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-760-available">Apache Solr™ 7.6.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-760-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 14 December 2018
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.6.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-760-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solrtm-750-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-750-available">Apache Solr™ 7.5.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-750-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 24 September 2018
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.5.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-750-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solrtm-665-available" class="post-item-title">
<a href="/news.html#apache-solrtm-665-available">Apache Solr™ 6.6.5
available</a>
<a class="headerlink" href="#apache-solrtm-665-available"
title="Permanent link">¶</a>
@@ -373,45 +412,6 @@
<a href="/news.html#apache-solrtm-701-available">Read full article on
news page →</a>
</div>
<hr/>
- <h2 id="apache-solr-reference-guide-for-70-available"
class="post-item-title">
- <a
href="/news.html#apache-solr-reference-guide-for-70-available">Apache Solr
Reference Guide for 7.0 available</a>
- <a class="headerlink"
href="#apache-solr-reference-guide-for-70-available" title="Permanent
link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 2 October 2017
- </h5>
- <p>The Lucene PMC is pleased to announce the release of the Apache Solr
Reference Guide for Solr 7.0. This 1,035-page PDF is the definitive guide to
Solr. This version adds documentation for new features of Solr, plus detailed
information about changes and deprecations you should know about when …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-reference-guide-for-70-available">Read
full article on news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solrtm-700-available" class="post-item-title">
- <a href="/news.html#apache-solrtm-700-available">Apache Solr™ 7.0.0
available</a>
- <a class="headerlink" href="#apache-solrtm-700-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 20 September 2017
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.0.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search and analytics, rich document parsing,
geospatial search, extensive …</p>
- <div class="read-more">
- <a href="/news.html#apache-solrtm-700-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2
id="cve-2017-9803-security-vulnerability-in-kerberos-delegation-token-functionality"
class="post-item-title">
- <a
href="/news.html#cve-2017-9803-security-vulnerability-in-kerberos-delegation-token-functionality">CVE-2017-9803:
Security vulnerability in kerberos delegation token functionality**</a>
- <a class="headerlink"
href="#cve-2017-9803-security-vulnerability-in-kerberos-delegation-token-functionality"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>Security:</strong>
- 18 September 2017
- </h5>
- <p>CVE-2017-9803: Security vulnerability in kerberos delegation token
functionality Severity: Important Vendor: The Apache Software Foundation
Versions Affected: Solr 6.2.0 to 6.6.0 Description: Solr's Kerberos plugin can
be configured to use delegation tokens, which allows an application to reuse
the authentication of an end-user or another application …</p>
- <div class="read-more">
- <a
href="/news.html#cve-2017-9803-security-vulnerability-in-kerberos-delegation-token-functionality">Read
full article on news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts5.html">← Previous</a>
diff --git a/output/posts7.html b/output/posts7.html
index 921809370..f11937b0a 100644
--- a/output/posts7.html
+++ b/output/posts7.html
@@ -152,6 +152,45 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solr-reference-guide-for-70-available"
class="post-item-title">
+ <a
href="/news.html#apache-solr-reference-guide-for-70-available">Apache Solr
Reference Guide for 7.0 available</a>
+ <a class="headerlink"
href="#apache-solr-reference-guide-for-70-available" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 2 October 2017
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of the Apache Solr
Reference Guide for Solr 7.0. This 1,035-page PDF is the definitive guide to
Solr. This version adds documentation for new features of Solr, plus detailed
information about changes and deprecations you should know about when …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-reference-guide-for-70-available">Read
full article on news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solrtm-700-available" class="post-item-title">
+ <a href="/news.html#apache-solrtm-700-available">Apache Solr™ 7.0.0
available</a>
+ <a class="headerlink" href="#apache-solrtm-700-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 20 September 2017
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
7.0.0 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search and analytics, rich document parsing,
geospatial search, extensive …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solrtm-700-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2
id="cve-2017-9803-security-vulnerability-in-kerberos-delegation-token-functionality"
class="post-item-title">
+ <a
href="/news.html#cve-2017-9803-security-vulnerability-in-kerberos-delegation-token-functionality">CVE-2017-9803:
Security vulnerability in kerberos delegation token functionality**</a>
+ <a class="headerlink"
href="#cve-2017-9803-security-vulnerability-in-kerberos-delegation-token-functionality"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>Security:</strong>
+ 18 September 2017
+ </h5>
+ <p>CVE-2017-9803: Security vulnerability in kerberos delegation token
functionality Severity: Important Vendor: The Apache Software Foundation
Versions Affected: Solr 6.2.0 to 6.6.0 Description: Solr's Kerberos plugin can
be configured to use delegation tokens, which allows an application to reuse
the authentication of an end-user or another application …</p>
+ <div class="read-more">
+ <a
href="/news.html#cve-2017-9803-security-vulnerability-in-kerberos-delegation-token-functionality">Read
full article on news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solrtm-661-available" class="post-item-title">
<a href="/news.html#apache-solrtm-661-available">Apache Solr™ 6.6.1
available</a>
<a class="headerlink" href="#apache-solrtm-661-available"
title="Permanent link">¶</a>
@@ -373,45 +412,6 @@
<a href="/news.html#apache-solr-620-available">Read full article on
news page →</a>
</div>
<hr/>
- <h2 id="apache-solr-552-available" class="post-item-title">
- <a href="/news.html#apache-solr-552-available">Apache Solr 5.5.2
available</a>
- <a class="headerlink" href="#apache-solr-552-available" title="Permanent
link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 25 June 2016
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
5.5.2 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-552-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solr-610-available" class="post-item-title">
- <a href="/news.html#apache-solr-610-available">Apache Solr 6.1.0
available</a>
- <a class="headerlink" href="#apache-solr-610-available" title="Permanent
link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 17 June 2016
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
6.1.0. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search and analytics, rich document parsing,
geospatial search, extensive …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-610-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solr-601-available" class="post-item-title">
- <a href="/news.html#apache-solr-601-available">Apache Solr 6.0.1
available</a>
- <a class="headerlink" href="#apache-solr-601-available" title="Permanent
link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 28 May 2016
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
6.0.1 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-601-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts6.html">← Previous</a>
diff --git a/output/posts8.html b/output/posts8.html
index 8195358c3..68659c68b 100644
--- a/output/posts8.html
+++ b/output/posts8.html
@@ -152,6 +152,45 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solr-552-available" class="post-item-title">
+ <a href="/news.html#apache-solr-552-available">Apache Solr 5.5.2
available</a>
+ <a class="headerlink" href="#apache-solr-552-available" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 25 June 2016
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
5.5.2 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-552-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solr-610-available" class="post-item-title">
+ <a href="/news.html#apache-solr-610-available">Apache Solr 6.1.0
available</a>
+ <a class="headerlink" href="#apache-solr-610-available" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 17 June 2016
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
6.1.0. Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search and analytics, rich document parsing,
geospatial search, extensive …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-610-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solr-601-available" class="post-item-title">
+ <a href="/news.html#apache-solr-601-available">Apache Solr 6.0.1
available</a>
+ <a class="headerlink" href="#apache-solr-601-available" title="Permanent
link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 28 May 2016
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
6.0.1 Solr is the popular, blazing fast, open source NoSQL search platform from
the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-601-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solr-551-available" class="post-item-title">
<a href="/news.html#apache-solr-551-available">Apache Solr 5.5.1
Available</a>
<a class="headerlink" href="#apache-solr-551-available" title="Permanent
link">¶</a>
@@ -373,45 +412,6 @@
<a
href="/news.html#apache-solr-500-and-reference-guide-for-50-available">Read
full article on news page →</a>
</div>
<hr/>
- <h2 id="apache-solr-4103-available" class="post-item-title">
- <a href="/news.html#apache-solr-4103-available">Apache Solr 4.10.3
Available</a>
- <a class="headerlink" href="#apache-solr-4103-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 29 December 2014
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
4.10.3 Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-4103-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solr-4102-available" class="post-item-title">
- <a href="/news.html#apache-solr-4102-available">Apache Solr 4.10.2
Available</a>
- <a class="headerlink" href="#apache-solr-4102-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 31 October 2014
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
4.10.2 Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-4102-available">Read full article on
news page →</a>
- </div>
- <hr/>
- <h2 id="apache-solr-4101-available" class="post-item-title">
- <a href="/news.html#apache-solr-4101-available">Apache Solr 4.10.1
Available</a>
- <a class="headerlink" href="#apache-solr-4101-available"
title="Permanent link">¶</a>
- </h2>
- <h5>
- <strong>News:</strong>
- 29 September 2014
- </h5>
- <p>The Lucene PMC is pleased to announce the release of Apache Solr
4.10.1 Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
- <div class="read-more">
- <a href="/news.html#apache-solr-4101-available">Read full article on
news page →</a>
- </div>
- <hr/>
<div class="pagination">
<a href="/posts7.html">← Previous</a>
diff --git a/output/posts9.html b/output/posts9.html
index 570bacd30..d383fa866 100644
--- a/output/posts9.html
+++ b/output/posts9.html
@@ -152,6 +152,45 @@
<h1 id="solr-news">Solr<sup>™</sup> News<a class="headerlink"
href="#solr-news" title="Permanent link">¶</a></h1>
+ <h2 id="apache-solr-4103-available" class="post-item-title">
+ <a href="/news.html#apache-solr-4103-available">Apache Solr 4.10.3
Available</a>
+ <a class="headerlink" href="#apache-solr-4103-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 29 December 2014
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
4.10.3 Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-4103-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solr-4102-available" class="post-item-title">
+ <a href="/news.html#apache-solr-4102-available">Apache Solr 4.10.2
Available</a>
+ <a class="headerlink" href="#apache-solr-4102-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 31 October 2014
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
4.10.2 Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-4102-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
+ <h2 id="apache-solr-4101-available" class="post-item-title">
+ <a href="/news.html#apache-solr-4101-available">Apache Solr 4.10.1
Available</a>
+ <a class="headerlink" href="#apache-solr-4101-available"
title="Permanent link">¶</a>
+ </h2>
+ <h5>
+ <strong>News:</strong>
+ 29 September 2014
+ </h5>
+ <p>The Lucene PMC is pleased to announce the release of Apache Solr
4.10.1 Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Lucene project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document (e.g …</p>
+ <div class="read-more">
+ <a href="/news.html#apache-solr-4101-available">Read full article on
news page →</a>
+ </div>
+ <hr/>
<h2 id="apache-solr-491-available" class="post-item-title">
<a href="/news.html#apache-solr-491-available">Apache Solr 4.9.1
Available</a>
<a class="headerlink" href="#apache-solr-491-available" title="Permanent
link">¶</a>
diff --git a/output/security-news.html b/output/security-news.html
index 144485098..9cb987e37 100644
--- a/output/security-news.html
+++ b/output/security-news.html
@@ -144,6 +144,44 @@
<h1 id="solr-security-news">Solr<sup>™</sup> Security News<a
class="headerlink" href="#solr-security-news" title="Permanent link">¶</a></h1>
<p>Full history of Apache Solr security advisories. Subscribe to the <a
href="/feeds/solr/security.atom.xml">security ATOM feed</a> to be notified of
new advisories.</p>
+ <h2
id="jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">2026-05-19,
JWT Authentication: blockUnknown default allows unauthenticated access
contrary to documentation
+ <a class="headerlink"
href="#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation"
title="Permanent link">¶</a>
+ </h2>
+ <p><strong>Severity</strong>
+moderate</p>
+<p><strong>Versions Affected</strong></p>
+<ul>
+<li>Apache Solr 9.0.0 through 9.10.1</li>
+<li>Apache Solr 10.0.0</li>
+</ul>
+<p><strong>Description</strong></p>
+<p>The Apache Solr JWT Authentication Plugin has a configuration parameter
<code>blockUnknown</code>
+that controls whether anonymous (unauthenticated) requests are blocked. The
Reference Guide
+has documented this as defaulting to <code>true</code> since Solr 9.0, but the
code default has always
+been <code>false</code>. Operators who did not explicitly set this parameter
may therefore have been
+unknowingly accepting anonymous requests.</p>
+<p><strong>Am I Affected?</strong></p>
+<p>You may be affected if <strong>all</strong> of the following are true:</p>
+<ol>
+<li>You use the JWT Authentication Plugin (<code>solr.JWTAuthPlugin</code>) in
<code>security.json</code></li>
+<li>Your intention is to block all unauthenticated requests</li>
+<li>Your <code>security.json</code> does <strong>not</strong> explicitly set
<code>blockUnknown</code> to <code>true</code></li>
+</ol>
+<p>You are <strong>not</strong> affected if any of the following applies:</p>
+<ul>
+<li><code>blockUnknown</code> is explicitly set to <code>true</code> in
<code>security.json</code></li>
+<li>An AuthorizationPlugin (e.g. <code>RuleBasedAuthorizationPlugin</code>)
independently denies access to unauthenticated users</li>
+</ul>
+<p><strong>Mitigation</strong></p>
+<p>Check the <code>authentication</code> section of your
<code>security.json</code>. If <code>blockUnknown</code> is absent, set it
explicitly to <code>true</code>.</p>
+<p><strong>Fix</strong></p>
+<p>Upcoming Solr 9.11 and 10.1 releases will change the code default of
<code>blockUnknown</code> to <code>true</code>.
+Explicitly setting <code>blockUnknown</code> to <code>true</code> in a current
release is sufficient; upgrading is not required.</p>
+<p><strong>References</strong></p>
+<ul>
+<li><a
href="https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html";>JWT
Authentication Plugin documentation</a></li>
+</ul>
+ <hr/>
<h2
id="cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin">2026-01-20,
CVE-2026-22022: Unauthorized bypass of certain "predefined permission" rules
in the RuleBasedAuthorizationPlugin
<a class="headerlink"
href="#cve-2026-22022-unauthorized-bypass-of-certain-predefined-permission-rules-in-the-rulebasedauthorizationplugin"
title="Permanent link">¶</a>
</h2>
@@ -630,31 +668,6 @@ Geza Nagy</p>
<p><strong>References:</strong>
<a href="https://issues.apache.org/jira/browse/SOLR-15233";>SOLR-15233</a>:
CVE-2021-29943: Apache Solr Unprivileged users may be able to perform
unauthorized read/write to collections </p>
<hr/>
- <h2
id="cve-2020-13957-the-checks-added-to-unauthenticated-configset-uploads-in-apache-solr-can-be-circumvented">2020-10-12,
CVE-2020-13957: The checks added to unauthenticated configset uploads in
Apache Solr can be circumvented
- <a class="headerlink"
href="#cve-2020-13957-the-checks-added-to-unauthenticated-configset-uploads-in-apache-solr-can-be-circumvented"
title="Permanent link">¶</a>
- </h2>
- <p><strong>Severity:</strong>
-High</p>
-<p><strong>Versions Affected:</strong>
-6.6.0 to 6.6.6
-7.0.0 to 7.7.3
-8.0.0 to 8.6.2</p>
-<p><strong>Description:</strong>
-Solr prevents some features considered dangerous (which could be used for
remote code execution) to be configured in a ConfigSet that's uploaded via API
without authentication/authorization. The checks in place to prevent such
features can be circumvented by using a combination of UPLOAD/CREATE
actions.</p>
-<p><strong>Mitigation:</strong>
-Any of the following are enough to prevent this vulnerability:</p>
-<ul>
-<li>Disable UPLOAD command in ConfigSets API if not used by setting the system
property: <code>configset.upload.enabled</code> to <code>false</code> (<a
href="https://solr.apache.org/guide/8_6/configsets-api.html";>see docs</a>)</li>
-<li>Use Authentication/Authorization and make sure unknown requests aren't
allowed (<a
href="https://solr.apache.org/guide/8_6/authentication-and-authorization-plugins.html";>see
docs</a>)</li>
-<li>Upgrade to <code>Solr 8.6.3</code> or greater.</li>
-<li>If upgrading is not an option, consider applying the patch in <a
href="https://issues.apache.org/jira/browse/SOLR-14663";>SOLR-14663</a></li>
-<li>No Solr API, including the Admin UI, is designed to be exposed to
non-trusted parties. Tune your firewall so that only trusted computers and
people are allowed access</li>
-</ul>
-<p><strong>Credit:</strong>
-Tomás Fernández Löbbe, András Salamon</p>
-<p><strong>References:</strong>
-<a href="https://issues.apache.org/jira/browse/SOLR-14925";>SOLR-14925</a>:
CVE-2020-13957: The checks added to unauthenticated configset uploads can be
circumvented</p>
- <hr/>
<div class="pagination">
<span class="pagination-info">
diff --git a/output/security-news2.html b/output/security-news2.html
index 413b144d4..a7835f009 100644
--- a/output/security-news2.html
+++ b/output/security-news2.html
@@ -144,6 +144,31 @@
<h1 id="solr-security-news">Solr<sup>™</sup> Security News<a
class="headerlink" href="#solr-security-news" title="Permanent link">¶</a></h1>
<p>Full history of Apache Solr security advisories. Subscribe to the <a
href="/feeds/solr/security.atom.xml">security ATOM feed</a> to be notified of
new advisories.</p>
+ <h2
id="cve-2020-13957-the-checks-added-to-unauthenticated-configset-uploads-in-apache-solr-can-be-circumvented">2020-10-12,
CVE-2020-13957: The checks added to unauthenticated configset uploads in
Apache Solr can be circumvented
+ <a class="headerlink"
href="#cve-2020-13957-the-checks-added-to-unauthenticated-configset-uploads-in-apache-solr-can-be-circumvented"
title="Permanent link">¶</a>
+ </h2>
+ <p><strong>Severity:</strong>
+High</p>
+<p><strong>Versions Affected:</strong>
+6.6.0 to 6.6.6
+7.0.0 to 7.7.3
+8.0.0 to 8.6.2</p>
+<p><strong>Description:</strong>
+Solr prevents some features considered dangerous (which could be used for
remote code execution) to be configured in a ConfigSet that's uploaded via API
without authentication/authorization. The checks in place to prevent such
features can be circumvented by using a combination of UPLOAD/CREATE
actions.</p>
+<p><strong>Mitigation:</strong>
+Any of the following are enough to prevent this vulnerability:</p>
+<ul>
+<li>Disable UPLOAD command in ConfigSets API if not used by setting the system
property: <code>configset.upload.enabled</code> to <code>false</code> (<a
href="https://solr.apache.org/guide/8_6/configsets-api.html";>see docs</a>)</li>
+<li>Use Authentication/Authorization and make sure unknown requests aren't
allowed (<a
href="https://solr.apache.org/guide/8_6/authentication-and-authorization-plugins.html";>see
docs</a>)</li>
+<li>Upgrade to <code>Solr 8.6.3</code> or greater.</li>
+<li>If upgrading is not an option, consider applying the patch in <a
href="https://issues.apache.org/jira/browse/SOLR-14663";>SOLR-14663</a></li>
+<li>No Solr API, including the Admin UI, is designed to be exposed to
non-trusted parties. Tune your firewall so that only trusted computers and
people are allowed access</li>
+</ul>
+<p><strong>Credit:</strong>
+Tomás Fernández Löbbe, András Salamon</p>
+<p><strong>References:</strong>
+<a href="https://issues.apache.org/jira/browse/SOLR-14925";>SOLR-14925</a>:
CVE-2020-13957: The checks added to unauthenticated configset uploads can be
circumvented</p>
+ <hr/>
<h2
id="cve-2020-13941-apache-solr-information-disclosure-vulnerability">2020-08-14,
CVE-2020-13941: Apache Solr information disclosure vulnerability
<a class="headerlink"
href="#cve-2020-13941-apache-solr-information-disclosure-vulnerability"
title="Permanent link">¶</a>
</h2>
diff --git a/output/security-reporting.html b/output/security-reporting.html
index 56b88bbde..b07d2fbfb 100644
--- a/output/security-reporting.html
+++ b/output/security-reporting.html
@@ -284,7 +284,7 @@ Click each entry to expand and view the template.</p>
Thank you for your security report.
We have received your report and created a private issue to track it.
-The Solr PMC will review your report and aim to update you within 30 days.
+The Solr PMC will review your report and aim to update you within 90 days.
We will keep you informed through this email thread.
Please do not discuss this report on public channels (mailing lists,
diff --git a/output/security.html b/output/security.html
index edf59fb71..a36b5e328 100644
--- a/output/security.html
+++ b/output/security.html
@@ -174,8 +174,8 @@ output, or references multiple dependencies at the same
time is likely to be ign
The large number of reports about already-known issues is a serious drag on
our volunteer time —
<strong>please search Jira</strong> before opening a new issue.</p>
- <h2 id="recent-cve-disclosures-for-apache-solr">Recent CVE Disclosures for
Apache Solr
- <a class="headerlink" href="#recent-cve-disclosures-for-apache-solr"
title="Permanent link">¶</a>
+ <h2 id="recent-security-advisories">Recent Security Advisories for Apache
Solr
+ <a class="headerlink" href="#recent-security-advisories" title="Permanent
link">¶</a>
</h2>
<p>The five most recent security advisories.</p>
@@ -185,6 +185,11 @@ The large number of reports about already-known issues is
a serious drag on our
<th width="95">Date</th>
<th>Announcement</th>
</tr>
+ <tr>
+ <td></td>
+ <td>2026-05-19</td>
+ <td><a
href="/security-news.html#jwt-authentication-blockunknown-default-allows-unauthenticated-access-contrary-to-documentation">JWT
Authentication: blockUnknown default allows unauthenticated access contrary to
documentation</a></td>
+ </tr>
<tr>
<td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-22022";>CVE-2026-22022</a></td>
<td>2026-01-20</td>
@@ -205,11 +210,6 @@ The large number of reports about already-known issues is
a serious drag on our
<td>2025-01-26</td>
<td><a
href="/security-news.html#cve-2024-52012-apache-solr-configset-upload-on-windows-allows-arbitrary-path-write-access">Apache
Solr: Configset upload on Windows allows arbitrary path write-access</a></td>
</tr>
- <tr>
- <td><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-24814";>CVE-2025-24814</a></td>
- <td>2025-01-26</td>
- <td><a
href="/security-news.html#cve-2025-24814-apache-solr-core-creation-with-trusted-configset-can-use-arbitrary-untrusted-files">Apache
Solr: Core-creation with "trusted" configset can use arbitrary untrusted
files</a></td>
- </tr>
</table>
<p><a href="/security-news.html">See full security news history →</a></p>
![https://solr.apache.org/theme/images/solr_og_image.png?v=033782dc"/](https://solr.apache.org/theme/images/solr_og_image.png?v=033782dc"/){kind=link}
![https://solr.apache.org/theme/solr/solr_og_image.png?v=033782dc"/](https://solr.apache.org/theme/solr/solr_og_image.png?v=033782dc"/){kind=link}