PT-2024-7646 · Apache · Apache Lucene.Net.Replicator

Apache Lucene + 2 · Published 2024-10-08 · Updated 2024-11-05 · CVE-2024-43383

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Lucene.Net.Replicator versions 4.8.0-beta00005 through 4.8.0-beta00016

Description This issue is related to the deserialization of untrusted data, which can result in remote code execution or other potential unauthorized access. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type.

Recommendations To resolve the issue, upgrade to version 4.8.0-beta00017, which fixes the issue. As a temporary workaround, consider restricting access to the vulnerable Replicator library to minimize the risk of exploitation. Avoid using the vulnerable library until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-09087

CVE-2024-43383

GHSA-2QW8-PPR5-M96C

Affected Products

Apache Lucene.Net.Replicator

References · 25

• https://bdu.fstec.ru/vul/2024-09087 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43383 · Security Note
• https://lists.apache.org/thread/wlz1p76dxpt4rl9o29voxjd5zl7717nh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43383 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2qw8-ppr5-m96c · Vendor Advisory
• https://github.com/apache/lucenenet · Note
• https://github.com/apache/lucenenet/pull/968 · Note
• https://github.com/apache/lucenenet/commit/1f61dd0fdb465e17141a79d22eb2f2bc02059acc · Note
• https://twitter.com/Brandefense/status/1853729331622580258 · Twitter Post
• https://nuget.org/packages/Lucene.Net.Replicator · Note
• https://twitter.com/Dinosn/status/1851970929552679174 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1851865548352565679 · Twitter Post
• https://t.me/cvedetector/9500 · Telegram Post
• https://twitter.com/fletch_ai/status/1852244251427639793 · Twitter Post
• https://t.me/cvenotify/100137 · Telegram Post