[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ANNOUNCE] [SECURITY] CVE-2017-7660: Security Vulnerability in secure inter-node communication in Apache Solr
- To: Lucene mailing list <general@xxxxxxxxxxxxxxxxx>, "dev@xxxxxxxxxxxxxxxxx" <dev@xxxxxxxxxxxxxxxxx>, java-user@xxxxxxxxxxxxxxxxx, solr-user@xxxxxxxxxxxxxxxxx, announce@xxxxxxxxxx, security <security@xxxxxxxxxx>, oss-security@xxxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx
- Subject: [ANNOUNCE] [SECURITY] CVE-2017-7660: Security Vulnerability in secure inter-node communication in Apache Solr
- From: Shalin Shekhar Mangar <shalin@xxxxxxxxxx>
- Date: Fri, 7 Jul 2017 19:14:02 +0530
CVE-2017-7660: Security Vulnerability in secure inter-node
communication in Apache Solr
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Solr 5.3 to 5.5.4
Solr 6.0 to 6.5.1
Description:
Solr uses a PKI based mechanism to secure inter-node communication
when security is enabled. It is possible to create a specially crafted
node name that does not exist as part of the cluster and point it to a
malicious node. This can trick the nodes in cluster to believe that
the malicious node is a member of the cluster. So, if Solr users have
enabled BasicAuth authentication mechanism using the BasicAuthPlugin
or if the user has implemented a custom Authentication plugin, which
does not implement either "HttpClientInterceptorPlugin" or
"HttpClientBuilderPlugin", his/her servers are vulnerable to this
attack. Users who only use SSL without basic authentication or those
who use Kerberos are not affected.
Mitigation:
6.x users should upgrade to 6.6
5.x users should obtain the latest source from git and apply this patch:
http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/2f5ecbcf
Credit:
This issue was discovered by Noble Paul of Lucidworks Inc.
References:
https://issues.apache.org/jira/browse/SOLR-10624
https://wiki.apache.org/solr/SolrSecurity
--
The Lucene PMC