Skip to content
OpenAdvisories
Critical DSA-4124-1 2 CVEs

lucene-solr - security update

Published Feb 27, 2018 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 8 lucene-solr 3.6.2+dfsg-5+deb8u1
Debian · 9 lucene-solr 3.6.2+dfsg-10+deb9u1

Vulnerabilities 2

  • Critical 9.8
    CVE-2017-12629 Public exploit Scanner template EPSS 92%

    Remote code execution occurs in Apache Solr

    Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulner…

    org.apache.solr:solr-core lucene-solr lucene-solr Debian Ubuntu Maven
  • High 7.5
    CVE-2017-3163

    Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core

    When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to cr…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven