On Monday, October 16, 2017 at 6:56:20 AM UTC-4, Anis wrote: > > Hi, as you may know Solr has been hit with a pretty severe 0-day ( > https://nvd.nist.gov/vuln/detail/CVE-2017-12629). AFAIK there's no patch > for it yet, but a workaround (adding the parameter > -Ddisable.configEdit=true), but when the patch is released, is it possible > to upgrade 4.10.2 solr to >7? Everything under the version 6.4 for solr has > been EOL for awhile now, and I think it would be critical to update it. > We're using DSpace 5.6. >
According to https://bugzilla.redhat.com/show_bug.cgi?id=1501529, Solr/Lucene v4 (which DSpace still uses) are unaffected. I have not tested this. Upgrading beyond v4 will require changing the way that a DSpace installation gets access to a Solr instance. From v5 on, Solr is packaged with embedded Jetty rather than as a WAR and is run in its own process. DSpace will need to change Solr from a dependency to a prerequisite, and we'll need to develop new instructions for installing the cores that DSpace needs. (I think that this change would be a Good Thing in any case.) In particular, we'll need to take a good look at how sharding is done, and changes may be required. In the meantime, by default DSpace's dedicated Solr instance is set up to listen only to localhost, which should limit the exposure to cases in which one has bigger problems (compromised localhost). If you've removed the localhost restriction filter then you may be more exposed, depending on firewalls and such. I don't know why you couldn't point DSpace at a Solr instance of your choice, given that you've installed suitably configured cores for the DSpace features that you use. There have been changes in the way that Solr is configured since v4, and some may require work on the cores that DSpace defines. Thank you for the heads-up. It raises questions for which we should be finding answers. -- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/dspace-tech. For more options, visit https://groups.google.com/d/optout.
