CVE-2017-12629
Critical · 9.8CVSS
9.8
EPSS
91.9%
Published
Oct 14, 2017
CISA due date
—
Cloudanix analysis
Schedule a fix
SSVC: Attend
A flaw in the search software lets attackers run any commands they want on the server by sending specially crafted requests, putting sensitive data and operations at risk.
Weaponized Chainable
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Remote Code Execution
- Component
- Application
- Class
- XXE
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Remote code execution occurs by exploiting XXE in the XML Query Parser (via deftype=xmlparser) combined with the Config API add-listener command to reach RunExecutableListener, allowing arbitrary command execution; also enables file upload or Blind XXE file reads.
Why it matters to the business
Enables full server compromise leading to data theft, service disruption, and lateral movement; high EPSS with weaponized exploits available increases urgency for patching despite the vulnerability's age.
How an attack unfolds
An attacker sends unauthenticated query requests with malicious XML using deftype=xmlparser to trigger XXE or invokes the Config API to add a listener reaching RunExecutableListener for RCE; can also use ftp wrapper for Blind XXE to read local files.
How to fix it
Upgrade Apache Solr to 7.1 or later; apply the listed fixed package versions including firefox-esr to 45.8.0esr-1 on Debian and firefox/thunderbird to the specified 52.0 and 45.8.0 builds on Ubuntu 14.04 LTS.
How to confirm the fix worked
Verify Solr version is 7.1+, test that XML Query Parser rejects external entities, and confirm Config API no longer allows RunExecutableListener registration.
Typical attack path
- Locate exposed Solr instance on the network
- Send crafted query with deftype=xmlparser containing XXE payload
- Use Config API add-listener to invoke RunExecutableListener
- Execute arbitrary OS commands or exfiltrate files
- Establish persistence or move laterally
How to detect it
Search Solr logs for queries containing deftype=xmlparser, XML external entity declarations, or Config API listener additions; look for unexpected process executions or file access artifacts tied to the RunExecutableListener.
- deftype=xmlparser
- RunExecutableListener
- add-listener
- XXE
- ftp://
What your security team should do
- Immediately upgrade all Solr instances to fixed versions
- Disable or restrict the XML Query Parser if upgrade is delayed
- Monitor for unusual query patterns and Config API usage
- Review and restrict network exposure of Solr endpoints
The record
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.solr:solr-core | 5.5.0 | 5.5.5 |
| Maven | org.apache.solr:solr-core | 6.0.0 | 6.6.2 |
| Maven | org.apache.solr:solr-core | 7.0.0 | 7.1.0 |
| Debian:11 | lucene-solr | 0 | 3.6.2+dfsg-11 |
| Debian:12 | lucene-solr | 0 | 3.6.2+dfsg-11 |
| Debian:13 | lucene-solr | 0 | 3.6.2+dfsg-11 |
| Debian:7 | lucene-solr | 0 | 3.6.0+dfsg-1+deb7u3 |
| Debian:8 | lucene-solr | 0 | 3.6.2+dfsg-5+deb8u1 |
| Debian:9 | lucene-solr | 0 | 3.6.2+dfsg-10+deb9u1 |
| Mageia:6 | lucene | 0 | 5.5.0-4.1.mga6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-cli | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-commons | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-core-client | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-dto | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-hornetq-protocol | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-hqclient-protocol | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-jms-client | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-jms-server | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-journal | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-native | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-ra | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-selector | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-server | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-activemq-artemis-service-extensions | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-hibernate | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-hibernate-core | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-hibernate-entitymanager | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-hibernate-envers | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-hibernate-infinispan | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-hibernate-java8 | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar-common-api | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar-common-impl | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar-common-spi | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar-core-api | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar-core-impl | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar-deployers-common | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar-jdbc | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-ironjacamar-validator | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-jboss-ec2-eap | 0 | 0:7.0.9-2.GA_redhat_2.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-jboss-ec2-eap-samples | 0 | 0:7.0.9-2.GA_redhat_2.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-jboss-remoting | 0 | 0:4.0.25-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-jboss-xnio-base | 0 | 0:3.4.7-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-jgroups | 0 | 0:3.6.12-1.Final_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-lucene-analyzers-common | 0 | 0:5.3.1-4.redhat_2.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-lucene-backward-codecs | 0 | 0:5.3.1-4.redhat_2.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-lucene-core | 0 | 0:5.3.1-4.redhat_2.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-lucene-facet | 0 | 0:5.3.1-4.redhat_2.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-lucene-misc | 0 | 0:5.3.1-4.redhat_2.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-lucene-queries | 0 | 0:5.3.1-4.redhat_2.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-lucene-queryparser | 0 | 0:5.3.1-4.redhat_2.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-lucene-solr | 0 | 0:5.3.1-4.redhat_2.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-async-http-servlet-3.0 | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-atom-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-cdi | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-client | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-crypto | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-jackson-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-jackson2-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-jaxb-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-jaxrs | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-jettison-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-jose-jwt | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-jsapi | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-json-p-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-multipart-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-spring | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-validator-provider-11 | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-resteasy-yaml-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-undertow | 0 | 0:1.3.31-3.Final_redhat_3.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-wildfly | 0 | 0:7.0.9-4.GA_redhat_3.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-wildfly-javadocs | 0 | 0:7.0.9-2.GA_redhat_3.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el6 | eap7-wildfly-modules | 0 | 0:7.0.9-4.GA_redhat_3.1.ep7.el6 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-cli | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-commons | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-core-client | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-dto | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-hornetq-protocol | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-hqclient-protocol | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-jms-client | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-jms-server | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-journal | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-native | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-ra | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-selector | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-server | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-activemq-artemis-service-extensions | 0 | 0:1.1.0-19.SP24_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-hibernate | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-hibernate-core | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-hibernate-entitymanager | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-hibernate-envers | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-hibernate-infinispan | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-hibernate-java8 | 0 | 0:5.0.16-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar-common-api | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar-common-impl | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar-common-spi | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar-core-api | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar-core-impl | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar-deployers-common | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar-jdbc | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-ironjacamar-validator | 0 | 0:1.3.8-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-jboss-ec2-eap | 0 | 0:7.0.9-2.GA_redhat_2.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-jboss-ec2-eap-samples | 0 | 0:7.0.9-2.GA_redhat_2.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-jboss-remoting | 0 | 0:4.0.25-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-jboss-xnio-base | 0 | 0:3.4.7-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-jgroups | 0 | 0:3.6.12-1.Final_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-lucene-analyzers-common | 0 | 0:5.3.1-4.redhat_2.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-lucene-backward-codecs | 0 | 0:5.3.1-4.redhat_2.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-lucene-core | 0 | 0:5.3.1-4.redhat_2.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-lucene-facet | 0 | 0:5.3.1-4.redhat_2.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-lucene-misc | 0 | 0:5.3.1-4.redhat_2.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-lucene-queries | 0 | 0:5.3.1-4.redhat_2.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-lucene-queryparser | 0 | 0:5.3.1-4.redhat_2.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-lucene-solr | 0 | 0:5.3.1-4.redhat_2.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-async-http-servlet-3.0 | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-atom-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-cdi | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-client | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-crypto | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-jackson-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-jackson2-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-jaxb-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-jaxrs | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-jettison-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-jose-jwt | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-jsapi | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-json-p-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-multipart-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-spring | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-validator-provider-11 | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-resteasy-yaml-provider | 0 | 0:3.0.19-7.SP5_redhat_1.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-undertow | 0 | 0:1.3.31-3.Final_redhat_3.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-wildfly | 0 | 0:7.0.9-4.GA_redhat_3.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-wildfly-javadocs | 0 | 0:7.0.9-2.GA_redhat_3.1.ep7.el7 |
| Red Hat:jboss_enterprise_application_platform:7::el7 | eap7-wildfly-modules | 0 | 0:7.0.9-4.GA_redhat_3.1.ep7.el7 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-analysis | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-analyzers-phonetic | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-analyzers-smartcn | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-analyzers-stempel | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-classification | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-codecs | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-facet | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-grouping | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-highlighter | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-javadoc | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-join | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-memory | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-misc | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-parent | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-queries | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-queryparser | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-replicator | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-sandbox | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-solr-grandparent | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene-suggest | 0 | 0:4.8.0-6.9.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5 | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-analysis | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-analyzers-smartcn | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-backward-codecs | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-classification | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-codecs | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-facet | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-grouping | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-highlighter | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-javadoc | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-join | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-memory | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-misc | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-parent | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-queries | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-queryparser | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-replicator | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-sandbox | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-solr-grandparent | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-lucene5-suggest | 0 | 0:5.4.1-2.4.el6 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-analysis | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-analyzers-phonetic | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-analyzers-smartcn | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-analyzers-stempel | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-classification | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-codecs | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-facet | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-grouping | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-highlighter | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-javadoc | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-join | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-memory | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-misc | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-parent | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-queries | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-queryparser | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-replicator | 0 | 0:4.8.0-6.9.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-lucene-sandbox | 0 | 0:4.8.0-6.9.el7 |
Related vulnerabilities
- CVE-2026-22022 Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the… Also affects org.apache.solr:solr-core
- CVE-2026-22444 Apache Solr: Insufficient file-access checking in standalone core-creation requests Also affects org.apache.solr:solr-core
- CVE-2024-52012 Apache Solr Relative Path Traversal vulnerability Also affects org.apache.solr:solr-core
- CVE-2023-50290 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. Also affects org.apache.solr:solr-core
- CVE-2012-6612 The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before… Also affects org.apache.solr:solr-core
- CVE-2013-6407 The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to… Also affects org.apache.solr:solr-core
- CVE-2013-6408 The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the… Also affects org.apache.solr:solr-core
- CVE-2013-6397 Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows… Also affects org.apache.solr:solr-core