epugh opened a new pull request, #225: URL: https://github.com/apache/solr-site/pull/225
The `not_affected` statement for **CVE-2020-13949** (Apache Thrift server-side DoS, affects `libthrift` 0.9.3–0.13.0, fixed in 0.14.0) listed its affected range as `8.2.0-8.8.1`, but Solr's optional `jaegertracer-configurator` module shipped an affected `libthrift` well past 8.8.1. Traced the actual bundled `libthrift` across the 8.x line: | Solr 8.x | libthrift | status | |---|---|---| | 8.2.0 – 8.4.1 | 0.12.0 | vulnerable | | 8.5.0 – 8.11.0 | 0.13.0 | vulnerable | | **8.11.1** | **0.14.1** | **fixed** | | 8.11.2+ | 0.14.1 | fixed | So the range should be **`8.2.0-8.11.0`**, with the upgrade landing in **8.11.1**. This matches the observation in [SOLR-15507](https://issues.apache.org/jira/browse/SOLR-15507) that Solr 8.9.0 still bundled `libthrift` 0.13.0. The 8.8.1 → 8.11.0 boundary was verified against the `solr:8.11.0` (0.13.0) and `solr:8.11.1` (0.14.1) release images. SOLR-15507 itself remains Open with no fix version, but the upgrade was in fact delivered in 8.11.1. Disposition is unchanged (`not_affected` / `code_not_reachable` — Solr uses Thrift only as a client). This only corrects the version metadata and the accompanying narrative. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
