CVE-2019-17558

Name	CVE-2019-17558
Description	Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lucene-solr (PTS)	jessie, jessie (lts)	3.6.2+dfsg-5+deb8u3	vulnerable
	stretch (security), stretch (lts), stretch	3.6.2+dfsg-10+deb9u3	vulnerable
	buster	3.6.2+dfsg-20+deb10u2	vulnerable
	bullseye	3.6.2+dfsg-24	vulnerable
	sid, trixie, bookworm	3.6.2+dfsg-26	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
lucene-solr	source	(unstable)	(unfixed)	unimportant

Notes

https://www.openwall.com/lists/oss-security/2019/12/30/1
https://issues.apache.org/jira/browse/SOLR-13971
https://issues.apache.org/jira/browse/SOLR-14025