This is an automated email from the ASF dual-hosted git repository.
epugh pushed a change to branch production
in repository https://gitbox.apache.org/repos/asf/solr-site.git
from 5f49e13a2 Merge main into production: deploy to live site
add 7004966f7 Describe why this CVE is not an issue for Solr
add 80f3dc963 reduce churn in this file by making sure keys are sorted
properly as we add new information.
add 7557fdd14 Merge pull request #213 from
epugh/sort-vex-dependency-versions
add fbf798000 Merge remote-tracking branch 'upstream/main' into
SOLR-17903-poi-cve
add 74b6fd0ab Merge pull request #212 from epugh/SOLR-17903-poi-cve
add 9e5e48982 Document that solr is not vulnerable to CVE-2024-21742
apache-mimej-core
add 36dd34cc2 Merge pull request #214 from epugh/SOLR-17901
add 09cedf173 Document the impact of these cves on Solr
add 559bf774e Merge pull request #215 from epugh/SOLR-17899
add 6ca22d491 Enhance OpenVEX generator so that aliases are expanded into
the one statement per id for suppression
add 1b587c51f Merge pull request #217 from
epugh/vex-openvex-per-cve-statements
add f1cc11ab1 Hadoop client CVEs, expand on one existing, add four new
ones. SOLR-17900
add 990c7a0ba Merge pull request #216 from epugh/SOLR-17900
add 8f50c780e Dug back in, and yeah, it was too broad.
add dd7b2f184 Merge pull request #224 from epugh/SOLR-17900-narrow-ranges
add 4a8b0a09a docuemnt that this was fixed "back in the day"
add 80f04a50f Merge pull request #222 from epugh/SOLR-15507
add 0892a5a3a Correct CVE-2020-13949 (thrift) affected range to
8.2.0-8.11.0
add 028f62617 Merge pull request #225 from epugh/SOLR-15507-thrift-range
add 9f1ba6a81 Expand the details to link to a Solr JIRA that highlights
the same issue.
add 51003dc98 Merge pull request #218 from epugh/SOLR-17236
add 3be42821a Refine jackson-databind gadget CVE range to 4.7.0-8.6.3
add 755853a45 Merge pull request #226 from
epugh/refine-jackson-gadget-cve-range
add f888daa16 Document the CVE, it's already partly covered in this
existing file
add 487c757b4 Merge pull request #219 from epugh/SOLR-18333
add bb6759e54 Split bundled 2026 jackson-databind VEX entry into per-CVE
files with accurate ranges
add 54850f413 Merge pull request #227 from epugh/split-jackson-2026-cves
add c15f7ca95 document the jquery-ui CVE applicablity.
add e5ad2f705 Merge pull request #221 from epugh/SOLR-16309
add 3e9a8be2f Expand existing file with additional CVES
add c36e834bd Merge pull request #220 from epugh/SOLR-18013
add 1034b61a2 Split lz4-java CVEs by fix boundary; emit real org.lz4 purl
add e2e945caf Merge pull request #228 from epugh/SOLR-18013-lz4-vex
add 311e206e2 Document that in 9.0 and 9.1 we had exploitable CVE
add d9452fe26 Merge pull request #223 from epugh/SOLR-10702
add 73b3893b3 Cap CVE-2025-48734 (commons-beanutils) range at
9.10.1/10.0.0 (fixed in 9.11/10.1)
add fb48899b7 Merge pull request #229 from epugh/SOLR-17825-beanutils-range
add e32918364 Fix regenerator: don't count a repackaged jar's embedded
Maven metadata as the artifact
add 05b33dd50 rebuilt dependencies plus enhance script.
add c8af5c0bc Merge pull request #230 from epugh/fix-regen-shaded-guava
new 9c1384e74 Merge branch 'main' into production
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
content/solr/vex/2022-12-14-cve-2017-15095.md | 6 +-
content/solr/vex/2025-09-07-cve-2020-13949.md | 30 ++
content/solr/vex/2025-09-07-cve-2021-41182.md | 45 ++
content/solr/vex/2025-09-07-cve-2023-33201.md | 47 ++
content/solr/vex/2025-09-07-cve-2023-52428.md | 27 ++
content/solr/vex/2025-09-07-cve-2024-21742.md | 30 ++
content/solr/vex/2025-09-07-cve-2024-25638.md | 27 ++
content/solr/vex/2025-09-07-cve-2024-26308.md | 28 ++
content/solr/vex/2025-09-07-cve-2024-29131.md | 31 ++
content/solr/vex/2025-09-07-cve-2025-31672.md | 30 ++
content/solr/vex/2026-07-18-cve-2025-48734.md | 10 +-
content/solr/vex/2026-07-31-cve-2024-47561.md | 11 +-
content/solr/vex/2026-07-31-cve-2026-50193.md | 44 +-
content/solr/vex/2026-07-31-cve-2026-54514.md | 28 ++
content/solr/vex/2026-07-31-cve-2026-54515.md | 29 ++
content/solr/vex/2026-07-31-cve-2026-59888.md | 27 ++
content/solr/vex/2026-07-31-cve-2026-59889.md | 25 ++
content/solr/vex/2026-07-31-cve-2026-59949.md | 30 +-
content/solr/vex/2026-07-31-ghsa-mhm7-754m-9p8w.md | 27 ++
content/solr/vex/2026-08-11-cve-2022-40152.md | 35 ++
content/solr/vex/2026-08-13-cve-2025-12183.md | 39 ++
plugins/vex/regenerate_dependency_mappings.py | 53 ++-
plugins/vex/solr-dependency-versions.json | 497 ++++++++++++++++-----
plugins/vex/vex.py | 16 +-
24 files changed, 1004 insertions(+), 168 deletions(-)
create mode 100644 content/solr/vex/2025-09-07-cve-2020-13949.md
create mode 100644 content/solr/vex/2025-09-07-cve-2021-41182.md
create mode 100644 content/solr/vex/2025-09-07-cve-2023-33201.md
create mode 100644 content/solr/vex/2025-09-07-cve-2023-52428.md
create mode 100644 content/solr/vex/2025-09-07-cve-2024-21742.md
create mode 100644 content/solr/vex/2025-09-07-cve-2024-25638.md
create mode 100644 content/solr/vex/2025-09-07-cve-2024-26308.md
create mode 100644 content/solr/vex/2025-09-07-cve-2024-29131.md
create mode 100644 content/solr/vex/2025-09-07-cve-2025-31672.md
create mode 100644 content/solr/vex/2026-07-31-cve-2026-54514.md
create mode 100644 content/solr/vex/2026-07-31-cve-2026-54515.md
create mode 100644 content/solr/vex/2026-07-31-cve-2026-59888.md
create mode 100644 content/solr/vex/2026-07-31-cve-2026-59889.md
create mode 100644 content/solr/vex/2026-07-31-ghsa-mhm7-754m-9p8w.md
create mode 100644 content/solr/vex/2026-08-11-cve-2022-40152.md
create mode 100644 content/solr/vex/2026-08-13-cve-2025-12183.md
