You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "Nazerke Seidan (Jira)" <ji...@apache.org> on 2021/04/19 16:06:00 UTC
[jira] [Updated] (SOLR-15355) CVE-2020-9492: Upgrade
hadoop-hdfs-client to 3.2.2
[ https://issues.apache.org/jira/browse/SOLR-15355?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Nazerke Seidan updated SOLR-15355:
----------------------------------
Description: CVE-2020-9492 vuln. issue is found in 8x component - *maven:org.apache.hadoop:hadoop-hdfs-client* (version-*3.2.0*) It seems with the version 3.2.0 hdfs client might send authorization header to remote url without verification. ([https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9492]) (was: CVE-2020-9492 vuln. issue is found in *maven:org.apache.hadoop:hadoop-hdfs-client* (version-*3.2.0*) It seems with the version 3.2.0 hdfs client might send authorization header to remote url without verification. (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9492))
> CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
> --------------------------------------------------
>
> Key: SOLR-15355
> URL: https://issues.apache.org/jira/browse/SOLR-15355
> Project: Solr
> Issue Type: Bug
> Security Level: Public(Default Security Level. Issues are Public)
> Components: hdfs, security
> Affects Versions: 8.6, 8.6.2
> Reporter: Nazerke Seidan
> Priority: Major
>
> CVE-2020-9492 vuln. issue is found in 8x component - *maven:org.apache.hadoop:hadoop-hdfs-client* (version-*3.2.0*) It seems with the version 3.2.0 hdfs client might send authorization header to remote url without verification. ([https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9492])
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org