PT-2024-31762 · Apache · Apache Lucene

Paul Irwin + 1 · Published 2024-09-30 · Updated 2025-05-15 · CVE-2024-45772

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Lucene versions 4.4.0 through 9.11.0

Description: The issue is related to the deserialization of untrusted data in the Apache Lucene Replicator. It affects the deprecated org.apache.lucene.replicator.http package, but not the org.apache.lucene.replicator.nrt package. The deserialization can only be triggered if users actively deploy a network-accessible implementation and a corresponding client using a HTTP library that uses the API.

Recommendations: For versions 4.4.0 through 9.11.0, upgrade to version 9.12.0 to fix the issue. As a temporary workaround, consider using Java serialization filters, such as -Djdk.serialFilter='!*' on the command line, to mitigate the issue on vulnerable versions without impacting functionality.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-45772

GHSA-G643-XQ6W-R67C

Affected Products

Apache Lucene

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-45772 · Security Note
• https://lists.apache.org/thread/3f3oph7bqnqspb9q5p0gm5mgc1b6thjo · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45772 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g643-xq6w-r67c · Vendor Advisory
• https://t.me/cvenotify/96526 · Telegram Post
• https://t.me/cvedetector/6648 · Telegram Post
• https://t.me/cvenotify/97027 · Telegram Post
• https://twitter.com/CVEnew/status/1840682756390674595 · Twitter Post
• https://t.me/cvenotify/122364 · Telegram Post
• http://openwall.com/lists/oss-security/2024/09/29/1 · Note
• https://gitbox.apache.org/repos/asf?p=lucene.git · Note