This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new 97b44a91e Commit build products
97b44a91e is described below
commit 97b44a91e2ec2aaad63c0617059df3c861ab60af
Author: Build Pelican (action) <[email protected]>
AuthorDate: Tue Aug 25 17:46:25 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 49 ++++--
output/feeds/solr/vex.atom.xml | 47 +++--
output/security-dependency-cves.html | 9 +
output/solr.openvex.json | 31 +++-
output/solr.vex.json | 325 ++++++++++++++++++-----------------
output/vex.html | 57 ++++++
6 files changed, 341 insertions(+), 177 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index 585a8ad15..42fff68b2 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,40 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-08-13T00:00:00+00:00</updated><entry><title>lz4-java:
out-of-bounds memory access and insufficient buffer clearing in
compression/decompression</title><link href="/cve-2025-12183.html"
rel="alternate"/><published>2026-08-13T00:00:00+00:00</published><updated>2026-08-13T00:00:00+00:00</updated><author><name>Solr
Developers [...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr</title><link
href="/" rel="alternate"/><link href="/feeds/all.atom.xml"
rel="self"/><id>/</id><updated>2026-08-23T00:00:00+00:00</updated><entry><title>Netty:
SslHandler native crash on crafted packets</title><link
href="/cve-2025-24970.html"
rel="alternate"/><published>2026-08-23T00:00:00+00:00</published><updated>2026-08-23T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-23:/cve-2025- [...]
+<code>netty-tcnative</code>) TLS engine is in use, a specially
crafted packet received during TLS
+processing is not properly validated, which can trigger a native crash (JVM
segfault) rather
+than a clean exception. It affects Netty
<code>netty-handler</code> versions 4 …</p></summary><content
type="html"><p>CVE-2025-24970 is a flaw in Netty's
<code>SslHandler</code>: when the native (OpenSSL/BoringSSL, via
+<code>netty-tcnative</code>) TLS engine is in use, a specially
crafted packet received during TLS
+processing is not properly validated, which can trigger a native crash (JVM
segfault) rather
+than a clean exception. It affects Netty
<code>netty-handler</code> versions 4.1.91.Final through
+4.1.117.Final; fixed in 4.1.118.Final. The 4.2.x release line is not in the
affected range at
+all — 4.2.0.Final was cut after the fix had already landed upstream.</p>
+<p>Solr shipped an affected <code>netty-handler</code> from
9.3.0 (4.1.93.Final) through 9.9.0
+(4.1.114.Final), arriving as a transitive runtime dependency of
<code>io.grpc:grpc-netty</code>, used only
+by the optional <strong>opentelemetry</strong> module's OTLP gRPC
trace exporter. Solr 9.10.0 onward already
+ships Netty 4.2.6.Final or later — outside the affected range — so no
currently released Solr
+version bundles a vulnerable <code>netty-handler</code>. Solr is
<strong>not affected</strong> even on the older,
+already-released 9.3.0–9.9.0 line:</p>
+<ul>
+<li><strong>The opentelemetry module is optional and disabled by
default.</strong> It must be explicitly
+ enabled (e.g. via <code>-Dsolr.modules=opentelemetry</code>)
before <code>grpc-netty</code>, and therefore
+ <code>netty-handler</code>, is even loaded.</li>
+<li><strong>Netty is used only as an outbound gRPC client dialing
the operator's own configured OTLP
+ collector</strong>, not as a listener accepting arbitrary inbound
connections. <code>SslHandler</code>'s
+ crafted-packet validation only matters for TLS data arriving from the remote
peer on that
+ connection — here, the operator-designated collector endpoint, not an
attacker-facing socket.</li>
+<li><strong>Solr's own request-handling surface is Jetty, not
Netty.</strong> Every attacker-facing API call
+ Solr accepts is parsed and served by Jetty;
<code>io.netty</code> code is never invoked to process
+ inbound requests to Solr itself.</li>
+<li>Exploitation would additionally require the operator to have pointed
OTLP export at a
+ compromised or malicious collector (or accepted an on-path attacker on that
egress route) —
+ a threat model outside standard use of this optional telemetry
feature.</li>
+</ul>
+<p>No released Solr version ships a fix for this specific line, because
none currently needs one:
+9.10.0+ already carries a post-fix Netty. The
<code>branch_9x</code> (→ 9.11.0) and
<code>main</code>/<code>branch_10x</code>
+(→ 10.x) development branches have since moved further still, to Netty
4.2.15.Final and
+4.2.17.Final respectively — picked up incidentally through routine dependency
updates rather
+than a targeted SOLR-17826 fix commit. SOLR-17826 remains open upstream and
should be closed
+out to reflect that no supported or in-development Solr line is
exposed.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds memory access
and insufficient buffer clearing in compression/decompression</title><link
href="/cve-2025-12183.html"
rel="alternate"/><published>2026-08-13T00:00:00+00:00</published><updated>2026-08-13T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-13:/cve-2025-12183.html</id><summar
[...]
<ul>
<li><strong>CVE-2025-12183</strong> — several lz4-java
compression/decompression implementations do not guard against
out-of-bounds memory access (fixed in <code>lz4-java</code>
1.8.1).</li>
@@ -2390,14 +2425,4 @@ In these versions, the following protections have been
added:</p>
L3yx (reporter)</p>
<p><strong>References:</strong><br>
JIRA - <a
href="https://issues.apache.org/jira/browse/SOLR-16949">SOLR-16949</a><br>
-CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50386">CVE-2023-50386</a></p></content><category
term="solr/security"/></entry><entry><title>Apache Solr™ 9.4.1
available</title><link href="/apache-solrtm-941-available.html"
rel="alternate"/><published>2024-01-18T00:00:00+00:00</published><updated>2024-01-18T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2024-01-18:/apache-solrtm-941-available.html</id><summary
type="html">< [...]
-<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Solr project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and …</p></summary><content
type="html"><p>The Solr PMC is pleased to announce the release of Apache
Solr 9.4.1.</p>
-<p>Solr is the popular, blazing fast, open source NoSQL search platform
from the Apache Solr project. Its major features include powerful full-text
search, hit highlighting, faceted search, dynamic clustering, database
integration, rich document handling, and geospatial search. Solr is highly
scalable, providing fault tolerant distributed search and indexing, and powers
the search and navigation features of many of the world's largest internet
sites.</p>
-<p>Solr 9.4.1 is available for immediate download at:</p>
-<p><a
href="https://solr.apache.org/downloads.html">https://solr.apache.org/downloads.html</a></p>
-<h3 id="solr-941-release-highlights">Solr 9.4.1 Release Highlights:<a
class="headerlink" href="#solr-941-release-highlights" title="Permanent
link">&para;</a></h3>
-<p>A big regression to the JSON Query API in 9.4 is primarily what
prompted this release. Additionally, some security oriented improvements/fixes
have been added, and many transitive dependencies have been upgraded.</p>
-<p>Please refer to the Upgrade Notes in the Solr Ref Guide for
information on upgrading from previous Solr versions:</p>
-<p><a
href="https://solr.apache.org/guide/solr/9_4/upgrade-notes/solr-upgrade-notes.html">https://solr.apache.org/guide/solr/9_4/upgrade-notes/solr-upgrade-notes.html</a></p>
-<p>Please read CHANGES.txt for a full list of bugfixes:</p>
-<p><a
href="https://solr.apache.org/9_4_1/changes/Changes.html">https://solr.apache.org/9_4_1/changes/Changes.html</a></p></content><category
term="solr/news"/></entry></feed>
\ No newline at end of file
+CVE - <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-50386">CVE-2023-50386</a></p></content><category
term="solr/security"/></entry></feed>
\ No newline at end of file
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index dfec1c86b..a8f7a1607 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -1,5 +1,40 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-08-13T00:00:00+00:00</updated><entry><title>lz4-java:
out-of-bounds memory access and insufficient buffer clearing in
compression/decompression</title><link href="/cve-2025-12183.html"
rel="alternate"/><published>2026-08-13T00:00:00+00:00</published><updated>2026-08-13T00:00:00+00:00</updated><author><name
[...]
+<feed xmlns="http://www.w3.org/2005/Atom";><title>Apache Solr -
solr/vex</title><link href="/" rel="alternate"/><link
href="/feeds/solr/vex.atom.xml"
rel="self"/><id>/</id><updated>2026-08-23T00:00:00+00:00</updated><entry><title>Netty:
SslHandler native crash on crafted packets</title><link
href="/cve-2025-24970.html"
rel="alternate"/><published>2026-08-23T00:00:00+00:00</published><updated>2026-08-23T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026- [...]
+<code>netty-tcnative</code>) TLS engine is in use, a specially
crafted packet received during TLS
+processing is not properly validated, which can trigger a native crash (JVM
segfault) rather
+than a clean exception. It affects Netty
<code>netty-handler</code> versions 4 …</p></summary><content
type="html"><p>CVE-2025-24970 is a flaw in Netty's
<code>SslHandler</code>: when the native (OpenSSL/BoringSSL, via
+<code>netty-tcnative</code>) TLS engine is in use, a specially
crafted packet received during TLS
+processing is not properly validated, which can trigger a native crash (JVM
segfault) rather
+than a clean exception. It affects Netty
<code>netty-handler</code> versions 4.1.91.Final through
+4.1.117.Final; fixed in 4.1.118.Final. The 4.2.x release line is not in the
affected range at
+all — 4.2.0.Final was cut after the fix had already landed upstream.</p>
+<p>Solr shipped an affected <code>netty-handler</code> from
9.3.0 (4.1.93.Final) through 9.9.0
+(4.1.114.Final), arriving as a transitive runtime dependency of
<code>io.grpc:grpc-netty</code>, used only
+by the optional <strong>opentelemetry</strong> module's OTLP gRPC
trace exporter. Solr 9.10.0 onward already
+ships Netty 4.2.6.Final or later — outside the affected range — so no
currently released Solr
+version bundles a vulnerable <code>netty-handler</code>. Solr is
<strong>not affected</strong> even on the older,
+already-released 9.3.0–9.9.0 line:</p>
+<ul>
+<li><strong>The opentelemetry module is optional and disabled by
default.</strong> It must be explicitly
+ enabled (e.g. via <code>-Dsolr.modules=opentelemetry</code>)
before <code>grpc-netty</code>, and therefore
+ <code>netty-handler</code>, is even loaded.</li>
+<li><strong>Netty is used only as an outbound gRPC client dialing
the operator's own configured OTLP
+ collector</strong>, not as a listener accepting arbitrary inbound
connections. <code>SslHandler</code>'s
+ crafted-packet validation only matters for TLS data arriving from the remote
peer on that
+ connection — here, the operator-designated collector endpoint, not an
attacker-facing socket.</li>
+<li><strong>Solr's own request-handling surface is Jetty, not
Netty.</strong> Every attacker-facing API call
+ Solr accepts is parsed and served by Jetty;
<code>io.netty</code> code is never invoked to process
+ inbound requests to Solr itself.</li>
+<li>Exploitation would additionally require the operator to have pointed
OTLP export at a
+ compromised or malicious collector (or accepted an on-path attacker on that
egress route) —
+ a threat model outside standard use of this optional telemetry
feature.</li>
+</ul>
+<p>No released Solr version ships a fix for this specific line, because
none currently needs one:
+9.10.0+ already carries a post-fix Netty. The
<code>branch_9x</code> (→ 9.11.0) and
<code>main</code>/<code>branch_10x</code>
+(→ 10.x) development branches have since moved further still, to Netty
4.2.15.Final and
+4.2.17.Final respectively — picked up incidentally through routine dependency
updates rather
+than a targeted SOLR-17826 fix commit. SOLR-17826 remains open upstream and
should be closed
+out to reflect that no supported or in-development Solr line is
exposed.</p></content><category
term="solr/vex"/></entry><entry><title>lz4-java: out-of-bounds memory access
and insufficient buffer clearing in compression/decompression</title><link
href="/cve-2025-12183.html"
rel="alternate"/><published>2026-08-13T00:00:00+00:00</published><updated>2026-08-13T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2026-08-13:/cve-2025-12183.html</id><summar
[...]
<ul>
<li><strong>CVE-2025-12183</strong> — several lz4-java
compression/decompression implementations do not guard against
out-of-bounds memory access (fixed in <code>lz4-java</code>
1.8.1).</li>
@@ -1684,12 +1719,4 @@ escape the input filename before passing it to a shell.
It affects <code>h
3.0.0-alpha–3.2.3 and 3.3.0–3.3.2 (fixed in 2.10.2, 3.2.4 and 3.3.3). Solr has
bundled an affected
<code>hadoop-common</code> (transitively, for HDFS support) since
Solr 4.4.0, through Solr 9.0.0 (which ships
3.3.2); Solr 9.1.0 upgraded to the fixed 3.3.4. The affected range is
therefore 4.4.0 – 9.0.0.</p>
-<p>The vulnerable code won't be used by Solr because Solr only is only
using HDFS as a client.</p></content><category
term="solr/vex"/></entry><entry><title>commons-configuration2</title><link
href="/cve-2022-33980.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2022-33980.html</id><summary
type="html"><p>CVE-2022-33980 is a code-e [...]
-performed variable interpolation with <code>script</code>,
<code>dns</code> and <code>url</code> lookups enabled
by default (fixed in
-2.8.0). Only Solr 9.0.0 shipped an affected version
(<code>commons-configuration2</code> 2.7); Solr 8.x shipped
-2.1 …</p></summary><content type="html"><p>CVE-2022-33980 is a
code-execution issue in Apache Commons Configuration: versions 2.4 through 2.7
-performed variable interpolation with <code>script</code>,
<code>dns</code> and <code>url</code> lookups enabled
by default (fixed in
-2.8.0). Only Solr 9.0.0 shipped an affected version
(<code>commons-configuration2</code> 2.7); Solr 8.x shipped
-2.1.1 (before the flaw was introduced) and Solr 9.1.0 upgraded to the fixed
2.8.0. The affected
-version is therefore 9.0.0 only.</p>
-<p>Solr uses commons-configuration2 for "hadoop-auth" only (for
Kerberos). It is only used for loading Hadoop configuration files that would
only ever be provided by trusted administrators, not externally
(untrusted).</p></content><category term="solr/vex"/></entry></feed>
\ No newline at end of file
+<p>The vulnerable code won't be used by Solr because Solr only is only
using HDFS as a client.</p></content><category
term="solr/vex"/></entry></feed>
\ No newline at end of file
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index 76f678ca4..ba1516766 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -191,6 +191,15 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-24970";>CVE-2025-24970</a>
</td>
+ <td>9.3.0-9.9.0</td>
+ <td>
+ netty-handler-4.1.114.Final.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2025-24970">Netty: SslHandler native crash on
crafted packets</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a>
</td>
<td>9.8.0-10.0.0</td>
<td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
index 02ef64c30..64f84263e 100644
--- a/output/solr.openvex.json
+++ b/output/solr.openvex.json
@@ -2,7 +2,7 @@
"@context": "https://openvex.dev/ns/v0.2.0";,
"@id": "https://solr.apache.org/solr.openvex.json";,
"author": "Apache Solr Project ([email protected])",
- "timestamp": "2026-08-13T00:00:00Z",
+ "timestamp": "2026-08-23T00:00:00Z",
"version": 1,
"statements": [
{
@@ -4323,6 +4323,35 @@
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "Two issues in the `lz4-java` codec:\n\n*
**CVE-2025-12183** \u2014 several lz4-java compression/decompression
implementations do not guard against\n out-of-bounds memory access (fixed in
`lz4-java` 1.8.1).\n* **CVE-2025-66566** \u2014 decompressor implementations
insufficiently clear their buffers, allowing a\n caller to read leftover
contents of a previously used buffer (fixed in `lz4-java` 1.10.1).\n\nBoth
require an application to drive lz4-java's (de)comp [...]
"status_notes": "Affected Apache Solr versions: 9.8.0-10.0.0."
+ },
+ {
+ "vulnerability": {
+ "name": "CVE-2025-24970"
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/io.netty/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2026-08-23T00:00:00Z",
+ "impact_statement": "CVE-2025-24970 is a flaw in Netty's `SslHandler`:
when the native (OpenSSL/BoringSSL, via\n`netty-tcnative`) TLS engine is in
use, a specially crafted packet received during TLS\nprocessing is not properly
validated, which can trigger a native crash (JVM segfault) rather\nthan a clean
exception. It affects Netty `netty-handler` versions 4.1.91.Final
through\n4.1.117.Final; fixed in 4.1.118.Final. The 4.2.x release line is not
in the affected range at\nall \u201 [...]
+ "status_notes": "Affected Apache Solr versions: 9.3.0-9.9.0."
}
]
}
\ No newline at end of file
diff --git a/output/solr.vex.json b/output/solr.vex.json
index 73b2c093d..e75c79ccf 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "bom-ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1087,7 +1087,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1104,7 +1104,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1121,7 +1121,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1138,7 +1138,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1155,7 +1155,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1172,7 +1172,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1189,7 +1189,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1206,7 +1206,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1223,7 +1223,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1240,7 +1240,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1257,7 +1257,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1274,7 +1274,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1291,7 +1291,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1308,7 +1308,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1325,7 +1325,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1342,7 +1342,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1359,7 +1359,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1376,7 +1376,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1393,7 +1393,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1410,7 +1410,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1427,7 +1427,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1444,7 +1444,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1464,7 +1464,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1484,7 +1484,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1504,7 +1504,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1521,7 +1521,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1541,7 +1541,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1558,7 +1558,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1575,7 +1575,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1592,7 +1592,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1609,7 +1609,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1626,7 +1626,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1643,7 +1643,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1660,7 +1660,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1677,7 +1677,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1694,7 +1694,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1711,7 +1711,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1728,7 +1728,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1745,7 +1745,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1762,7 +1762,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1779,7 +1779,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1796,7 +1796,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1813,7 +1813,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1830,7 +1830,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1847,7 +1847,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1864,7 +1864,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1881,7 +1881,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1898,7 +1898,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1915,7 +1915,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1932,7 +1932,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1949,7 +1949,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1966,7 +1966,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -1983,7 +1983,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2000,7 +2000,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2017,7 +2017,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2034,7 +2034,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2051,7 +2051,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2068,7 +2068,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2085,7 +2085,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2102,7 +2102,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2119,7 +2119,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2136,7 +2136,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2153,7 +2153,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2170,7 +2170,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2187,7 +2187,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2204,7 +2204,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2221,7 +2221,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2238,7 +2238,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2255,7 +2255,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2272,7 +2272,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2289,7 +2289,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2306,7 +2306,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2323,7 +2323,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2340,7 +2340,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2357,7 +2357,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2374,7 +2374,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2391,7 +2391,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2408,7 +2408,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2425,7 +2425,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2442,7 +2442,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2459,7 +2459,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2476,7 +2476,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2493,7 +2493,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2510,7 +2510,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2529,7 +2529,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2546,7 +2546,7 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
},
@@ -2563,7 +2563,24 @@
},
"affects": [
{
- "ref": "1f72af82-5d37-5e80-ab99-8e6f4eb2ec4d"
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2025-24970",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "requires_configuration",
+ "detail": "CVE-2025-24970 is a flaw in Netty's `SslHandler`: when the
native (OpenSSL/BoringSSL, via\n`netty-tcnative`) TLS engine is in use, a
specially crafted packet received during TLS\nprocessing is not properly
validated, which can trigger a native crash (JVM segfault) rather\nthan a clean
exception. It affects Netty `netty-handler` versions 4.1.91.Final
through\n4.1.117.Final; fixed in 4.1.118.Final. The 4.2.x release line is not
in the affected range at\nall \u2014 4.2.0. [...]
+ },
+ "affects": [
+ {
+ "ref": "e95aefb5-54a3-502b-b5e1-ea3aa14bb312"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index ad1edc640..e7c86edb4 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -142,6 +142,63 @@
<h1>Apache Solr VEX</h1>
<p><a href="/security-dependency-cves.html">← Back to the dependency
CVE table</a></p>
+ <article id="cve-2025-24970" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-24970";>CVE-2025-24970</a>,
Netty: SslHandler native crash on crafted packets</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2026-08-23T00:00:00+00:00">2026-08-23</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 9.3.0-9.9.0</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>CVE-2025-24970 is a flaw in Netty's
<code>SslHandler</code>: when the native (OpenSSL/BoringSSL, via
+<code>netty-tcnative</code>) TLS engine is in use, a specially crafted packet
received during TLS
+processing is not properly validated, which can trigger a native crash (JVM
segfault) rather
+than a clean exception. It affects Netty <code>netty-handler</code> versions
4.1.91.Final through
+4.1.117.Final; fixed in 4.1.118.Final. The 4.2.x release line is not in the
affected range at
+all — 4.2.0.Final was cut after the fix had already landed upstream.</p>
+<p>Solr shipped an affected <code>netty-handler</code> from 9.3.0
(4.1.93.Final) through 9.9.0
+(4.1.114.Final), arriving as a transitive runtime dependency of
<code>io.grpc:grpc-netty</code>, used only
+by the optional <strong>opentelemetry</strong> module's OTLP gRPC trace
exporter. Solr 9.10.0 onward already
+ships Netty 4.2.6.Final or later — outside the affected range — so no
currently released Solr
+version bundles a vulnerable <code>netty-handler</code>. Solr is <strong>not
affected</strong> even on the older,
+already-released 9.3.0–9.9.0 line:</p>
+<ul>
+<li><strong>The opentelemetry module is optional and disabled by
default.</strong> It must be explicitly
+ enabled (e.g. via <code>-Dsolr.modules=opentelemetry</code>) before
<code>grpc-netty</code>, and therefore
+ <code>netty-handler</code>, is even loaded.</li>
+<li><strong>Netty is used only as an outbound gRPC client dialing the
operator's own configured OTLP
+ collector</strong>, not as a listener accepting arbitrary inbound
connections. <code>SslHandler</code>'s
+ crafted-packet validation only matters for TLS data arriving from the remote
peer on that
+ connection — here, the operator-designated collector endpoint, not an
attacker-facing socket.</li>
+<li><strong>Solr's own request-handling surface is Jetty, not Netty.</strong>
Every attacker-facing API call
+ Solr accepts is parsed and served by Jetty; <code>io.netty</code> code is
never invoked to process
+ inbound requests to Solr itself.</li>
+<li>Exploitation would additionally require the operator to have pointed OTLP
export at a
+ compromised or malicious collector (or accepted an on-path attacker on that
egress route) —
+ a threat model outside standard use of this optional telemetry feature.</li>
+</ul>
+<p>No released Solr version ships a fix for this specific line, because none
currently needs one:
+9.10.0+ already carries a post-fix Netty. The <code>branch_9x</code> (→
9.11.0) and <code>main</code>/<code>branch_10x</code>
+(→ 10.x) development branches have since moved further still, to Netty
4.2.15.Final and
+4.2.17.Final respectively — picked up incidentally through routine dependency
updates rather
+than a targeted SOLR-17826 fix commit. SOLR-17826 remains open upstream and
should be closed
+out to reflect that no supported or in-development Solr line is exposed.</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-17826";>SOLR-17826</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-24970";>CVE-2025-24970</a></li>
+ </ul>
+ </article>
<article id="cve-2025-12183" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-12183";>CVE-2025-12183</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-66566";>CVE-2025-66566</a>,
lz4-java: out-of-bounds memory access and insufficient buffer clearing in
compression/decompression</h3>
