| Name | CVE-2019-12401 |
| Description | Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| lucene-solr (PTS) | jessie, jessie (lts) | 3.6.2+dfsg-5+deb8u3 | fixed |
| stretch (security), stretch (lts), stretch | 3.6.2+dfsg-10+deb9u3 | fixed |
| buster | 3.6.2+dfsg-20+deb10u2 | fixed |
| bullseye | 3.6.2+dfsg-24 | fixed |
| sid, trixie, bookworm | 3.6.2+dfsg-26 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| lucene-solr | source | wheezy | (unfixed) | end-of-life | | |
| lucene-solr | source | (unstable) | (not affected) | | | |
Notes
- lucene-solr <not-affected> (system libraries of libwoodstox-java and libstax-api-java are used in Debian)
https://issues.apache.org/jira/browse/SOLR-13750
https://www.openwall.com/lists/oss-security/2019/09/10/1
Upstream's fix (upgrading dependencies) suggests the issue is in libwoodstox-java:
https://issues.apache.org/jira/browse/SOLR-6830
May be related to the change in the 4.x series of libwoodstox-java to
disabling coalescing by default which can trigger large memory consumption
when parsing specially crafted XML data.