Re: [CVE-2020-13957] The checks added to unauthenticated configset uploads in Apache Solr can be circumvented

Thanks Bernd, I missed 6.6.6 because it's not marked as a released version in Jira. 6.6.6 is also affected. On Mon, Oct 12, 2020 at 11:47 PM Bernd Fehling < bernd.fehl...@uni-bielefeld.de> wrote: > Good to know that Version 6.6.6 is not affected, so I am safe ;-) > > Regards > Bernd > > Am

Re: [CVE-2020-13957] The checks added to unauthenticated configset uploads in Apache Solr can be circumvented

Good to know that Version 6.6.6 is not affected, so I am safe ;-) Regards Bernd Am 12.10.20 um 20:38 schrieb Tomas Fernandez Lobbe: > Severity: High > > Vendor: The Apache Software Foundation > > Versions Affected: > 6.6.0 to 6.6.5 > 7.0.0 to 7.7.3 > 8.0.0 to 8.6.2 > > Description: > Solr

[CVE-2020-13957] The checks added to unauthenticated configset uploads in Apache Solr can be circumvented

Severity: High Vendor: The Apache Software Foundation Versions Affected: 6.6.0 to 6.6.5 7.0.0 to 7.7.3 8.0.0 to 8.6.2 Description: Solr prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without