CVE-2020-13957

NameCVE-2020-13957
DescriptionApache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
lucene-solr (PTS)jessie, jessie (lts)3.6.2+dfsg-5+deb8u3fixed
stretch (security), stretch (lts), stretch3.6.2+dfsg-10+deb9u3fixed
buster3.6.2+dfsg-20+deb10u2fixed
bullseye3.6.2+dfsg-24fixed
sid, trixie, bookworm3.6.2+dfsg-26fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lucene-solrsource(unstable)(not affected)

Notes

- lucene-solr <not-affected> (Vulnerable functionality not yet present)

Search for package or bug name: Reporting problems