This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new fbf0b960a Commit build products
fbf0b960a is described below
commit fbf0b960a15b2a53363cd4f77328574b28fa8ad0
Author: Build Pelican (action) <[email protected]>
AuthorDate: Thu Aug 13 01:45:20 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 11 +-
output/feeds/solr/vex.atom.xml | 11 +-
output/security-dependency-cves.html | 2 +-
output/solr.openvex.json | 4 +-
output/solr.vex.json | 298 +++++++++++++++++------------------
output/vex.html | 13 +-
6 files changed, 174 insertions(+), 165 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index ad9dc40da..e43507cae 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1511,10 +1511,13 @@ by an application that runs a Thrift server accepting
messages from untrusted cl
integration, where Solr uses Thrift purely as a
<strong>client</strong> to export spans to an operator-configured
Jaeger collector — it never runs a Thrift RPC server that accepts untrusted
incoming messages. The
vulnerable server-side allocation path is therefore never reached.</p>
-<p>Solr shipped an affected <code>libthrift</code> in the
8.x line — 0.12.0 (8.2.0) and 0.13.0 (8.5.0 – 8.8.1),
-both ≤ 0.13.0 — so the affected range is 8.2.0 – 8.8.1. Solr 9.0.0 upgraded to
<code>libthrift</code> 0.14.1
-(and later 0.15.0), which are past the 0.14.0 fix, so no 9.x or 10.x release
is affected. (The Solr
-8.x line is end of life.)</p></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-33201.html</id><summary
type="html"><p>Four vulnerabilities in th [...]
+<p>Solr shipped an affected <code>libthrift</code> in the
8.x line — 0.12.0 (8.2.0 – 8.4.1) and 0.13.0 (8.5.0 –
+8.11.0), both ≤ 0.13.0 — so the affected range is 8.2.0 – 8.11.0. Solr
<strong>8.11.1</strong> upgraded the 8.x
+line to <code>libthrift</code> 0.14.1 (past the 0.14.0 fix), and
Solr 9.0.0 likewise ships 0.14.1 (later 0.15.0),
+so no 8.11.1+, 9.x, or 10.x release is affected. (The Solr 8.x line is end of
life.) Note that
+SOLR-15507 — which proposed the upgrade and observed that Solr 8.9.0 still
bundled <code>libthrift</code> 0.13.0 —
+remains open with no fix version, but the upgrade was in fact delivered in
8.11.1 (verified against the
+<code>solr:8.11.0</code> and <code>solr:8.11.1</code>
release images).</p></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-33 [...]
each in a distinct crypto operation:</p>
<ul>
<li><strong>CVE-2023-33201</strong> — LDAP injection in the
X.509 <code>CertStore</code> (fixed in 1.74); requires using Bouncy
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index 7adc8d16d..fff19317d 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -1279,10 +1279,13 @@ by an application that runs a Thrift server accepting
messages from untrusted cl
integration, where Solr uses Thrift purely as a
<strong>client</strong> to export spans to an operator-configured
Jaeger collector — it never runs a Thrift RPC server that accepts untrusted
incoming messages. The
vulnerable server-side allocation path is therefore never reached.</p>
-<p>Solr shipped an affected <code>libthrift</code> in the
8.x line — 0.12.0 (8.2.0) and 0.13.0 (8.5.0 – 8.8.1),
-both ≤ 0.13.0 — so the affected range is 8.2.0 – 8.8.1. Solr 9.0.0 upgraded to
<code>libthrift</code> 0.14.1
-(and later 0.15.0), which are past the 0.14.0 fix, so no 9.x or 10.x release
is affected. (The Solr
-8.x line is end of life.)</p></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-33201.html</id><summary
type="html"><p>Four vulnerabilities in th [...]
+<p>Solr shipped an affected <code>libthrift</code> in the
8.x line — 0.12.0 (8.2.0 – 8.4.1) and 0.13.0 (8.5.0 –
+8.11.0), both ≤ 0.13.0 — so the affected range is 8.2.0 – 8.11.0. Solr
<strong>8.11.1</strong> upgraded the 8.x
+line to <code>libthrift</code> 0.14.1 (past the 0.14.0 fix), and
Solr 9.0.0 likewise ships 0.14.1 (later 0.15.0),
+so no 8.11.1+, 9.x, or 10.x release is affected. (The Solr 8.x line is end of
life.) Note that
+SOLR-15507 — which proposed the upgrade and observed that Solr 8.9.0 still
bundled <code>libthrift</code> 0.13.0 —
+remains open with no fix version, but the upgrade was in fact delivered in
8.11.1 (verified against the
+<code>solr:8.11.0</code> and <code>solr:8.11.1</code>
release images).</p></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2023-33 [...]
each in a distinct crypto operation:</p>
<ul>
<li><strong>CVE-2023-33201</strong> — LDAP injection in the
X.509 <code>CertStore</code> (fixed in 1.74); requires using Bouncy
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index 4c8f95cb9..7db116932 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -687,7 +687,7 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
<tr>
<td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2020-13949";>CVE-2020-13949</a>
</td>
- <td>8.2.0-8.8.1</td>
+ <td>8.2.0-8.11.0</td>
<td>
libthrift-0.13.0.jar </td>
<td><span class="cdx-not-affected">not affected</span></td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
index e5e051e94..65a084d27 100644
--- a/output/solr.openvex.json
+++ b/output/solr.openvex.json
@@ -1508,8 +1508,8 @@
"status": "not_affected",
"timestamp": "2025-09-07T00:00:00Z",
"justification": "vulnerable_code_not_in_execute_path",
- "impact_statement": "CVE-2020-13949 is a denial-of-service issue in
Apache Thrift: a malicious RPC **client** can send\nspecially-crafted short
messages that cause a Thrift **server** to allocate a large amount of
memory,\npotentially exhausting it (affects `libthrift` 0.9.3 \u2013 0.13.0,
fixed in 0.14.0). It is reachable only\nby an application that runs a Thrift
server accepting messages from untrusted clients.\n\nSolr is **not affected**.
`libthrift` is bundled only by the opti [...]
- "status_notes": "Affected Apache Solr versions: 8.2.0-8.8.1."
+ "impact_statement": "CVE-2020-13949 is a denial-of-service issue in
Apache Thrift: a malicious RPC **client** can send\nspecially-crafted short
messages that cause a Thrift **server** to allocate a large amount of
memory,\npotentially exhausting it (affects `libthrift` 0.9.3 \u2013 0.13.0,
fixed in 0.14.0). It is reachable only\nby an application that runs a Thrift
server accepting messages from untrusted clients.\n\nSolr is **not affected**.
`libthrift` is bundled only by the opti [...]
+ "status_notes": "Affected Apache Solr versions: 8.2.0-8.11.0."
},
{
"vulnerability": {
diff --git a/output/solr.vex.json b/output/solr.vex.json
index 550808ba8..804a5da6d 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "bom-ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1087,7 +1087,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1104,7 +1104,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1117,11 +1117,11 @@
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
- "detail": "CVE-2020-13949 is a denial-of-service issue in Apache
Thrift: a malicious RPC **client** can send\nspecially-crafted short messages
that cause a Thrift **server** to allocate a large amount of
memory,\npotentially exhausting it (affects `libthrift` 0.9.3 \u2013 0.13.0,
fixed in 0.14.0). It is reachable only\nby an application that runs a Thrift
server accepting messages from untrusted clients.\n\nSolr is **not affected**.
`libthrift` is bundled only by the optional Jae [...]
+ "detail": "CVE-2020-13949 is a denial-of-service issue in Apache
Thrift: a malicious RPC **client** can send\nspecially-crafted short messages
that cause a Thrift **server** to allocate a large amount of
memory,\npotentially exhausting it (affects `libthrift` 0.9.3 \u2013 0.13.0,
fixed in 0.14.0). It is reachable only\nby an application that runs a Thrift
server accepting messages from untrusted clients.\n\nSolr is **not affected**.
`libthrift` is bundled only by the optional Jae [...]
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1138,7 +1138,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1155,7 +1155,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1172,7 +1172,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1189,7 +1189,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1206,7 +1206,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1223,7 +1223,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1240,7 +1240,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1257,7 +1257,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1274,7 +1274,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1291,7 +1291,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1308,7 +1308,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1325,7 +1325,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1342,7 +1342,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1359,7 +1359,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1376,7 +1376,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1393,7 +1393,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1413,7 +1413,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1433,7 +1433,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1453,7 +1453,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1470,7 +1470,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1490,7 +1490,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1507,7 +1507,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1524,7 +1524,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1541,7 +1541,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1558,7 +1558,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1575,7 +1575,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1592,7 +1592,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1609,7 +1609,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1626,7 +1626,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1643,7 +1643,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1660,7 +1660,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1677,7 +1677,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1694,7 +1694,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1711,7 +1711,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1728,7 +1728,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1745,7 +1745,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1762,7 +1762,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1779,7 +1779,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1796,7 +1796,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1813,7 +1813,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1830,7 +1830,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1847,7 +1847,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1864,7 +1864,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1881,7 +1881,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1898,7 +1898,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1915,7 +1915,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1932,7 +1932,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1949,7 +1949,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1966,7 +1966,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -1983,7 +1983,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2000,7 +2000,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2017,7 +2017,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2034,7 +2034,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2051,7 +2051,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2068,7 +2068,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2085,7 +2085,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2102,7 +2102,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2119,7 +2119,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2136,7 +2136,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2153,7 +2153,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2170,7 +2170,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2187,7 +2187,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2204,7 +2204,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2221,7 +2221,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2238,7 +2238,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2255,7 +2255,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2272,7 +2272,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2289,7 +2289,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2306,7 +2306,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2323,7 +2323,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2340,7 +2340,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2357,7 +2357,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2374,7 +2374,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2391,7 +2391,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2408,7 +2408,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2425,7 +2425,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2442,7 +2442,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
},
@@ -2459,7 +2459,7 @@
},
"affects": [
{
- "ref": "772b4fa6-18d7-5834-9d26-49313bbb8b4d"
+ "ref": "aea743ab-4bda-5ae9-9113-6c9f5fed126d"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index 31a4bd354..43237d2d4 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -2551,7 +2551,7 @@ module, fixed to 1.78.1 in 9.7; the same not-affected
reasoning applies.)</p>
<strong>Status:</strong>
<span class="cdx-not-affected">not_affected</span>
</p>
- <p class="subheader"><strong>Affected Solr
versions:</strong> 8.2.0-8.8.1</p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 8.2.0-8.11.0</p>
</div>
</header>
@@ -2564,10 +2564,13 @@ by an application that runs a Thrift server accepting
messages from untrusted cl
integration, where Solr uses Thrift purely as a <strong>client</strong> to
export spans to an operator-configured
Jaeger collector — it never runs a Thrift RPC server that accepts untrusted
incoming messages. The
vulnerable server-side allocation path is therefore never reached.</p>
-<p>Solr shipped an affected <code>libthrift</code> in the 8.x line — 0.12.0
(8.2.0) and 0.13.0 (8.5.0 – 8.8.1),
-both ≤ 0.13.0 — so the affected range is 8.2.0 – 8.8.1. Solr 9.0.0 upgraded to
<code>libthrift</code> 0.14.1
-(and later 0.15.0), which are past the 0.14.0 fix, so no 9.x or 10.x release
is affected. (The Solr
-8.x line is end of life.)</p>
+<p>Solr shipped an affected <code>libthrift</code> in the 8.x line — 0.12.0
(8.2.0 – 8.4.1) and 0.13.0 (8.5.0 –
+8.11.0), both ≤ 0.13.0 — so the affected range is 8.2.0 – 8.11.0. Solr
<strong>8.11.1</strong> upgraded the 8.x
+line to <code>libthrift</code> 0.14.1 (past the 0.14.0 fix), and Solr 9.0.0
likewise ships 0.14.1 (later 0.15.0),
+so no 8.11.1+, 9.x, or 10.x release is affected. (The Solr 8.x line is end of
life.) Note that
+SOLR-15507 — which proposed the upgrade and observed that Solr 8.9.0 still
bundled <code>libthrift</code> 0.13.0 —
+remains open with no fix version, but the upgrade was in fact delivered in
8.11.1 (verified against the
+<code>solr:8.11.0</code> and <code>solr:8.11.1</code> release images).</p>
<h4>References</h4>
<ul>
