PT-2019-12786 · Apache · Solr

Mal

+1

·

Published

2019-09-10

·

Updated

2023-02-28

·

CVE-2019-12401

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Solr versions 1.3.0 through 1.4.1 Solr versions 3.1.0 through 3.6.2 Solr versions 4.0.0 through 4.10.4 Solr versions prior to 5.0.0
Description The issue allows for an XML resource consumption attack, also known as a Lol Bomb, via the update handler. By using XML DOCTYPE and ENTITY type elements, an attacker can create a pattern that expands when the server parses the XML, causing out-of-memory (OOM) errors.
Recommendations For Solr versions 1.3.0 through 1.4.1, update to version 5.0.0 or later. For Solr versions 3.1.0 through 3.6.2, update to version 5.0.0 or later. For Solr versions 4.0.0 through 4.10.4, update to version 5.0.0 or later. For Solr versions prior to 5.0.0, update to version 5.0.0 or later. As a temporary workaround, consider restricting access to the update handler until a patch is available.

Exploit

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2019-12401
GHSA-JQ2W-W7V2-69Q5

Affected Products

Solr