Bug 22697 - solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802, CVE-2019-0193, CVE-2019-12401, CVE-2020-13941, CVE-2021-27905, CVE-2021-29262, CVE-2021-29943
Summary: solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2...
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: Java Stack Maintainers
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-03-03 20:50 CET by David Walser
Modified: 2021-07-01 18:14 CEST (History)
1 user (show)

See Also:
Source RPM: solr3-3.6.2-15.mga7.src.rpm
CVE:
Status comment: Patches available from Debian

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2018-03-03 20:50:44 CET 
Debian has issued an advisory on February 27:
https://www.debian.org/security/2018/dsa-4124

I'm not sure if the solr package is also affected (it may be).

Mageia 5 and Mageia 6 are also affected.
David Walser 2018-03-03 20:51:26 CET

Whiteboard: (none) => MGA6TOO

David Walser 2018-03-11 16:11:53 CET

Status comment: (none) => Patch available from Debian

Comment 1 David Walser 2018-04-09 00:28:05 CEST 
Upstream has issued an advisory today (April 8) for a new security issue:
http://openwall.com/lists/oss-security/2018/04/08/3

Status comment: Patch available from Debian => Patch available from Debian for first two CVEs
Summary: solr3 new security issues CVE-2017-3163 and CVE-2017-12629 => solr3 new security issues CVE-2017-3163, CVE-2017-12629, and CVE-2018-1308

Comment 2 David Walser 2018-05-12 23:46:40 CEST 
(In reply to David Walser from comment #1)
> Upstream has issued an advisory today (April 8) for a new security issue:
> http://openwall.com/lists/oss-security/2018/04/08/3

Debian has issued an advisory for this on May 6:
https://www.debian.org/security/2018/dsa-4194

Status comment: Patch available from Debian for first two CVEs => Patches available from Debian

Comment 3 David Walser 2019-02-13 03:50:45 CET 
Upstream has issued an advisory today (February 12):
https://www.openwall.com/lists/oss-security/2019/02/12/7

Severity: normal => critical
Summary: solr3 new security issues CVE-2017-3163, CVE-2017-12629, and CVE-2018-1308 => solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, and CVE-2018-1308

Comment 4 David Walser 2019-04-26 21:43:14 CEST 
Upstream has issued an advisory on April 24:
https://www.openwall.com/lists/oss-security/2019/04/24/1

Summary: solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, and CVE-2018-1308 => solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802

David Walser 2019-06-23 19:29:22 CEST

Whiteboard: MGA6TOO => MGA7TOO, MGA6TOO

Comment 5 David Walser 2019-08-06 12:49:43 CEST 
Upstream has issued an advisory on August 1:
https://www.openwall.com/lists/oss-security/2019/08/01/1

Summary: solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802 => solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802, CVE-2019-0193

Comment 6 David Walser 2019-09-10 12:04:14 CEST 
Upstream has issued an advisory on September 9:
https://www.openwall.com/lists/oss-security/2019/09/10/1

Summary: solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802, CVE-2019-0193 => solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802, CVE-2019-0193, CVE-2019-12401

Nicolas Lécureuil 2020-05-22 14:04:33 CEST

Whiteboard: MGA7TOO, MGA6TOO => MGA7TOO
CC: (none) => mageia

Comment 7 David Walser 2020-08-17 19:39:01 CEST 
Upstream has issued an advisory on August 14:
https://www.openwall.com/lists/oss-security/2020/08/15/1

Summary: solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802, CVE-2019-0193, CVE-2019-12401 => solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802, CVE-2019-0193, CVE-2019-12401, CVE-2020-13941

Comment 8 David Walser 2020-08-21 20:40:58 CEST 
(In reply to David Walser from comment #5)
> Upstream has issued an advisory on August 1:
> https://www.openwall.com/lists/oss-security/2019/08/01/1

Debian-LTS has issued an advisory for this on August 6:
https://www.debian.org/lts/security/2020/dla-2327
Comment 9 Nicolas Lécureuil 2020-12-26 23:24:46 CET 
not in cauldron anymore

Version: Cauldron => 7
Whiteboard: MGA7TOO => (none)

Comment 10 David Walser 2021-04-18 22:44:38 CEST 
Upstream has issued advisories on April 12:
https://www.openwall.com/lists/oss-security/2021/04/12/2
https://www.openwall.com/lists/oss-security/2021/04/12/3
https://www.openwall.com/lists/oss-security/2021/04/12/4

Summary: solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802, CVE-2019-0193, CVE-2019-12401, CVE-2020-13941 => solr3 new security issues CVE-2017-3163, CVE-2017-3164, CVE-2017-12629, CVE-2018-1308, CVE-2018-11802, CVE-2019-0193, CVE-2019-12401, CVE-2020-13941, CVE-2021-27905, CVE-2021-29262, CVE-2021-29943

Comment 11 David Walser 2021-07-01 18:14:22 CEST 
https://blog.mageia.org/en/2021/06/08/mageia-7-will-reach-end-of-support-on-30th-of-june-the-king-is-dead-long-live-the-king/

Resolution: (none) => OLD
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.