svn commit: r1053052 - in /websites/staging/lucene/trunk/content: ./ solr/news.html

[bu...@apache.org]

Author: buildbot
Date: Mon Nov 18 13:31:33 2019
New Revision: 1053052

Log:
Staging update by buildbot for lucene

Modified:
    websites/staging/lucene/trunk/content/   (props changed)
    websites/staging/lucene/trunk/content/solr/news.html

Propchange: websites/staging/lucene/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Mon Nov 18 13:31:33 2019
@@ -1 +1 @@
-1869961
+1869972

Modified: websites/staging/lucene/trunk/content/solr/news.html
==============================================================================
--- websites/staging/lucene/trunk/content/solr/news.html (original)
+++ websites/staging/lucene/trunk/content/solr/news.html Mon Nov 18 13:31:33 2019
@@ -195,6 +195,44 @@
 }
 h2:hover > .headerlink, h3:hover > .headerlink, h1:hover > .headerlink, h6:hover > .headerlink, h4:hover > .headerlink, h5:hover > .headerlink, dt:hover > .elementid-permalink { visibility: visible }</style>
 <h1 id="solr-news">Solr<sup>&trade;</sup> News<a class="headerlink" href="#solr-news" title="Permanent link">&para;</a></h1>
+<h2 id="18-november-2019-cve-2019-12409-apache-solr-rce-vulnerability-due-to-bad-config-default">18 November 2019, CVE-2019-12409: Apache Solr RCE vulnerability due to bad config default<a class="headerlink" href="#18-november-2019-cve-2019-12409-apache-solr-rce-vulnerability-due-to-bad-config-default" title="Permanent link">&para;</a></h2>
+<p><strong>Severity:</strong> High</p>
+<p><strong>Vendor:</strong><br />
+The Apache Software Foundation</p>
+<p><strong>Versions Affected:</strong><br />
+Solr 8.1.1 and 8.2.0 for Linux</p>
+<p><strong>Description:</strong> <br />
+The 8.1.1 and 8.2.0 releases of Apache Solr contain an
+insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option
+in the default solr.in.sh configuration file shipping with Solr.</p>
+<p>Windows users are not affected.</p>
+<p>If you use the default solr.in.sh file from the affected releases, then
+JMX monitoring will be enabled and exposed on RMI_PORT (default=18983),
+without any authentication. If this port is opened for inbound traffic
+in your firewall, then anyone with network access to your Solr nodes
+will be able to access JMX, which may in turn allow them to upload
+malicious code for execution on the Solr server.</p>
+<p>The vulnerability is already public <a href="https://www.apache.org/dyn/closer.cgi/lucene/solr/ref-guide/">1</a> and mitigation steps were
+announced on project mailing lists and news page <a href="https://www.apache.org/dyn/closer.cgi/lucene/solr/ref-guide/">3</a> on August 14th,
+without mentioning RCE at that time.</p>
+<p><strong>Mitigation:</strong><br />
+Make sure your effective solr.in.sh file has ENABLE_REMOTE_JMX_OPTS set
+to 'false' on every Solr node and then restart Solr. Note that the
+effective solr.in.sh file may reside in /etc/defaults/ or another
+location depending on the install. You can then validate that the
+'com.sun.management.jmxremote*' family of properties are not listed in
+the "Java Properties" section of the Solr Admin UI, or configured in a
+secure way.</p>
+<p>There is no need to upgrade or update any code.</p>
+<p>Remember to follow the Solr Documentation's advice to never expose Solr
+nodes directly in a hostile network environment.</p>
+<p><strong>Credit:</strong><br />
+Matei "Mal" Badanoiu<br />
+Solr JIRA user 'jnyryan' (John)</p>
+<p><strong>References:</strong><br />
+<a href="https://www.apache.org/dyn/closer.cgi/lucene/solr/ref-guide/">1</a> https://issues.apache.org/jira/browse/SOLR-13647<br />
+<a href="https://www.apache.org/dyn/closer.cgi/lucene/solr/ref-guide/">3</a> https://lucene.apache.org/solr/news.html
+</code></p>
 <h2 id="2-november-2019-apache-solrtm-830-available">2 November 2019, Apache Solr™ 8.3.0 available<a class="headerlink" href="#2-november-2019-apache-solrtm-830-available" title="Permanent link">&para;</a></h2>
 <p>The Lucene PMC is pleased to announce the release of Apache Solr 8.3.0.</p>
 <p>Solr is the popular, blazing fast, open source NoSQL search platform from the Apache Lucene project. Its major features include powerful full-text search, hit highlighting, faceted search, dynamic clustering, database integration, rich document handling, and geospatial search. Solr is highly scalable, providing fault tolerant distributed search and indexing, and powers the search and navigation features of many of the world's largest internet sites.</p>