https://bugzilla.redhat.com/show_bug.cgi?id=1179795
Bug ID: 1179795 Summary: CVE-2014-3628 solr: Cross-site scripting (XSS) vulnerability via the fieldvaluecache object Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: java-sig-commits@lists.fedoraproject.org, puntogil@libero.it
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-3628 to the following vulnerability:
Name: CVE-2014-3628 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3628 Assigned: 20140514 Reference: http://secunia.com/advisories/62024
Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object.
https://bugzilla.redhat.com/show_bug.cgi?id=1179795
gil cattaneo puntogil@libero.it changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |RAWHIDE Last Closed| |2015-01-07 10:17:05
--- Comment #1 from gil cattaneo puntogil@libero.it --- Solr 4.10.3 will be updated soon, are waiting to be able to fill. because requires Lucene 4.10.3. I do not know if it will be possible to upgrade it for F21 since Lucene is a dependency of eclipse. Close this bug
https://bugzilla.redhat.com/show_bug.cgi?id=1179795
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141229, |impact=low,public=20141229, |reported=20150107,source=cv |reported=20150107,source=cv |e,cvss2=3.5/AV:N/AC:M/Au:S/ |e,cvss2=3.5/AV:N/AC:M/Au:S/ |C:N/I:P/A:N,fedora-21/solr= |C:N/I:P/A:N,fedora-21/solr= |affected |notaffected,fedora-all/solr | |=notaffected,jdg-6.3.1/solr | |-core=new,jdv-6.0.0/solr-co | |re=new,fsw-6.0.0/solr-core= | |new,wfk-2/solr-core=new
https://bugzilla.redhat.com/show_bug.cgi?id=1179795
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |NEW Resolution|RAWHIDE |--- Keywords| |Reopened
--- Comment #2 from Vasyl Kaigorodov vkaigoro@redhat.com --- (In reply to gil cattaneo from comment #1)
Solr 4.10.3 will be updated soon, are waiting to be able to fill. because requires Lucene 4.10.3. I do not know if it will be possible to upgrade it for F21 since Lucene is a dependency of eclipse. Close this bug
Thanks for the comment, marked Fedora versions as "notaffected". This bug should be opened though, Solr is shipped in other Red Hat products and we need to check if these are affected or not. Please don't close this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1179795
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1179814
https://bugzilla.redhat.com/show_bug.cgi?id=1179795
Josh Bressers bressers@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141229, |impact=low,public=20141229, |reported=20150107,source=cv |reported=20150107,source=cv |e,cvss2=3.5/AV:N/AC:M/Au:S/ |e,cvss2=3.5/AV:N/AC:M/Au:S/ |C:N/I:P/A:N,fedora-21/solr= |C:N/I:P/A:N,fedora-21/solr= |notaffected,fedora-all/solr |notaffected,fedora-all/solr |=notaffected,jdg-6.3.1/solr |=notaffected,jdg-6.3.1/solr |-core=new,jdv-6.0.0/solr-co |-core=wontfix,jdv-6.0.0/sol |re=new,fsw-6.0.0/solr-core= |r-core=wontfix,fsw-6.0.0/so |new,wfk-2/solr-core=new |lr-core=wontfix,wfk-2/solr- | |core=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1179795
Josh Bressers bressers@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed|2015-01-07 10:17:05 |2015-01-12 15:36:29
https://bugzilla.redhat.com/show_bug.cgi?id=1179795
Ján Rusnačko jrusnack@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jrusnack@redhat.com Whiteboard|impact=low,public=20141229, |impact=low,public=20141229, |reported=20150107,source=cv |reported=20150107,source=cv |e,cvss2=3.5/AV:N/AC:M/Au:S/ |e,cvss2=3.5/AV:N/AC:M/Au:S/ |C:N/I:P/A:N,fedora-21/solr= |C:N/I:P/A:N,fedora-21/solr= |notaffected,fedora-all/solr |notaffected,fedora-all/solr |=notaffected,jdg-6.3.1/solr |=notaffected,jdg-6.3.1/solr |-core=wontfix,jdv-6.0.0/sol |-core=wontfix,jdv-6.0.0/sol |r-core=wontfix,fsw-6.0.0/so |r-core=wontfix,fsw-6.0.0/so |lr-core=wontfix,wfk-2/solr- |lr-core=wontfix,wfk-2/solr- |core=wontfix |core=wontfix,cwe=CWE-79
java-sig-commits@lists.fedoraproject.org