Non notée
CVE-2021-29262 When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or…
Description
When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Solr 8.8 | premières → < 8.8.2 | 8.8.2 |
Références
- lists.apache.org lists.apache.org
- security.netapp.com security.netapp.com
- [jackrabbit-oak-issues] 20210730 [jira] [Created] (OAK-9520) CVE-2021-29262 in oak-solr-osgi lists.apache.org
- [jackrabbit-oak-issues] 20210730 [jira] [Assigned] (OAK-9520) CVE-2021-29262 in oak-solr-osgi lists.apache.org
- [jackrabbit-oak-issues] 20210730 [jira] [Commented] (OAK-9520) CVE-2021-29262 in oak-solr-osgi lists.apache.org
- [jackrabbit-dev] 20210730 [GitHub] [jackrabbit-oak] nit0906 opened a new pull request #334: OAK-9520 | Updating solr version to handle/fix CVE-2021-29262 lists.apache.org
- [jackrabbit-oak-issues] 20210730 [jira] [Updated] (OAK-9520) CVE-2021-29262 in oak-solr-osgi lists.apache.org
- [jackrabbit-oak-issues] 20210730 [jira] [Resolved] (OAK-9520) CVE-2021-29262 in oak-solr-osgi lists.apache.org
- [jackrabbit-oak-commits] 20210730 [jackrabbit-oak] branch trunk updated: OAK-9520 | Updating solr version to handle/fix CVE-2021-29262 (#334) lists.apache.org
- [jackrabbit-dev] 20210730 [GitHub] [jackrabbit-oak] nit0906 merged pull request #334: OAK-9520 | Updating solr version to handle/fix CVE-2021-29262 lists.apache.org
- [jackrabbit-oak-issues] 20210730 [jira] [Commented] (OAK-9520) CVE-2021-29262 in oak-solr-osgi lists.apache.org
- [jackrabbit-oak-issues] 20211006 [jira] [Updated] (OAK-9520) CVE-2021-29262 in oak-solr-osgi lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Solr
Les 24 CVE de Apache Solr →
CVE-2026-44825
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0…
8.1
Élevée
CVE-2026-22022
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable…
Non notée
CVE-2026-22444
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters,…
Non notée
CVE-2025-24814
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use…
Non notée