CVE-2019-12401

NameCVE-2019-12401
DescriptionSolr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
lucene-solr (PTS)jessie, jessie (lts)3.6.2+dfsg-5+deb8u3fixed
stretch (security), stretch (lts), stretch3.6.2+dfsg-10+deb9u3fixed
buster3.6.2+dfsg-20+deb10u2fixed
bullseye3.6.2+dfsg-24fixed
sid, trixie, bookworm3.6.2+dfsg-26fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lucene-solrsourcewheezy(unfixed)end-of-life
lucene-solrsource(unstable)(not affected)

Notes

- lucene-solr <not-affected> (system libraries of libwoodstox-java and libstax-api-java are used in Debian)
https://issues.apache.org/jira/browse/SOLR-13750
https://www.openwall.com/lists/oss-security/2019/09/10/1
Upstream's fix (upgrading dependencies) suggests the issue is in libwoodstox-java:
https://issues.apache.org/jira/browse/SOLR-6830
May be related to the change in the 4.x series of libwoodstox-java to
disabling coalescing by default which can trigger large memory consumption
when parsing specially crafted XML data.

Search for package or bug name: Reporting problems