[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501529
--- Comment #43 from Sam Fowler <sfowler(a)redhat.com> ---
The OCP ose-metering-presto container pulls in a version lucene without the
upstream fix, due to its dependency on Elasticsearch:
$ podman run -it --entrypoint /bin/bash --user root
registry.redhat.io/openshift4/ose-metering-presto
bash-4.2# find . -name *.jar | grep lucene
./lib/lucene-analyzers-common-7.2.1.jar
./plugin/presto-elasticsearch/lucene-queries-7.0.1.jar
./plugin/presto-elasticsearch/lucene-memory-7.0.1.jar
./plugin/presto-elasticsearch/lucene-spatial3d-7.0.1.jar
./plugin/presto-elasticsearch/lucene-suggest-7.0.1.jar
./plugin/presto-elasticsearch/lucene-join-7.0.1.jar
./plugin/presto-elasticsearch/lucene-highlighter-7.0.1.jar
./plugin/presto-elasticsearch/lucene-backward-codecs-7.0.1.jar
./plugin/presto-elasticsearch/lucene-spatial-7.0.1.jar
./plugin/presto-elasticsearch/lucene-analyzers-common-7.2.1.jar
./plugin/presto-elasticsearch/lucene-queryparser-7.0.1.jar
./plugin/presto-elasticsearch/lucene-grouping-7.0.1.jar
./plugin/presto-elasticsearch/lucene-core-7.0.1.jar
./plugin/presto-elasticsearch/lucene-misc-7.0.1.jar
./plugin/presto-elasticsearch/lucene-spatial-extras-7.0.1.jar
./plugin/presto-elasticsearch/lucene-sandbox-7.0.1.jar
Similarly to Elasticsearch, the presto container is also not affected by this
vulnerability.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months