Skip to content
Log inStart free trial

GHSA-jq2w-w7v2-69q5 CVE-2019-12401

Apache Solr vulnerable to XML Bomb

High Maven
Severity
7.5 / 10
High · CVSS 3.1
Exploit chance (EPSS)
8.55%
Chance of exploitation in the next 30 days. Higher than 95.06% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Fix
5.0.0
Upgrade org.apache.solr:solr-core to this version or later

Description

Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it?s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.

Affected versions

Maven

PackageVulnerableFixed in
org.apache.solr:solr-core
< 5.0.0
5.0.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.apache.solr:solr-core Maven → 5.0.0

maven
<dependency><groupId>org.apache.solr</groupId><artifactId>solr-core</artifactId><version>5.0.0</version></dependency>
gradle
implementation("org.apache.solr:solr-core:5.0.0")

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Weakness

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

How to prevent it
  • Operation: If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
  • Implementation: Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

References

Advisories

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
CVE-2019-17558
Improper Input Validation in Apache Solr
High Known exploited Also affects org.apache.solr:solr-core
CVE-2019-0193
XML External Entity (XXE) Injection in Apache Solr
High Known exploited Also affects org.apache.solr:solr-core
GHSA-qhr7-h655-pw6r
Apache Solr has hardcoded credentials in the Basic Authentication setup tool
Critical Also affects org.apache.solr:solr-core
GHSA-vc2w-4v3p-2mqw
Apache Solr: Insufficient file-access checking in standalone core-creation requests
High Also affects org.apache.solr:solr-core
GHSA-qr3p-2xj2-q7hq
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
High Also affects org.apache.solr:solr-core
GHSA-68r2-fwcg-qpm8
Apache Solr vulnerable to Execution with Unnecessary Privileges
Medium Also affects org.apache.solr:solr-core
GHSA-4p5m-gvpf-f3x5
Apache Solr Relative Path Traversal vulnerability
Medium Also affects org.apache.solr:solr-core
GHSA-37vr-vmg4-jwpw
Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
High Also affects org.apache.solr:solr-core
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor