You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@solr.apache.org by Isabella Trevisan <is...@infocamere.it.INVALID> on 2023/10/27 08:16:41 UTC
Re: Apache SolR and CVE-2023-44487
Sorry , I correct the CVE number CVE-2023-44487.
Il giorno ven 27 ott 2023 alle ore 10:14 Isabella Trevisan <
isabella.trevisan@infocamere.it> ha scritto:
> Hi,
> On October 10th, news of this vulnerability came out, which also affected
> SolR.
> On the Apache SolR Security news page it is not yet mentioned.
> Can anyone provide me with some information on this vulnerability and SolR
> ?
>
> Thank you
> --
> Isabella Trevisan
>
Re: Apache SolR and CVE-2023-44487
Posted by Jan Høydahl <ja...@cominvent.com>.
Hi,
Why do you believe Solr is vulnerable to this CVE? The latest version 9.4.0 contains Jetty 10.0.17 <https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.17>.
Jan
> 27. okt. 2023 kl. 10:16 skrev Isabella Trevisan <is...@infocamere.it.INVALID>:
>
> Sorry , I correct the CVE number CVE-2023-44487.
>
> Il giorno ven 27 ott 2023 alle ore 10:14 Isabella Trevisan <
> isabella.trevisan@infocamere.it> ha scritto:
>
>> Hi,
>> On October 10th, news of this vulnerability came out, which also affected
>> SolR.
>> On the Apache SolR Security news page it is not yet mentioned.
>> Can anyone provide me with some information on this vulnerability and SolR
>> ?
>>
>> Thank you
>> --
>> Isabella Trevisan
>>
Re: Apache SolR and CVE-2023-44487
Posted by Isabella Trevisan <is...@infocamere.it.INVALID>.
Ok , Thank you Jan !!!
Best regards
Isabella
Il giorno ven 27 ott 2023 alle ore 10:36 Jan Høydahl <ja...@cominvent.com>
ha scritto:
> There is work in progress on a 8.11.3 release, which will include Jetty
> 9.4.53.v20231009 which also is not vulnearble.
> Follow the dev-list for details on the progress of this release.
>
> Jan
>
> > 27. okt. 2023 kl. 10:32 skrev Isabella Trevisan
> <is...@infocamere.it.INVALID>:
> >
> > I read that version 9.4.0 mitigates this vulnerability but my version of
> > solr is 8.11.2.
> > Is there a workaround for version 8.11.2?
> >
> > Thank you
> > Regards
> > Isabella
> >
> >
> > Il giorno ven 27 ott 2023 alle ore 10:16 Isabella Trevisan <
> > isabella.trevisan@infocamere.it> ha scritto:
> >
> >> Sorry , I correct the CVE number CVE-2023-44487.
> >>
> >> Il giorno ven 27 ott 2023 alle ore 10:14 Isabella Trevisan <
> >> isabella.trevisan@infocamere.it> ha scritto:
> >>
> >>> Hi,
> >>> On October 10th, news of this vulnerability came out, which also
> >>> affected SolR.
> >>> On the Apache SolR Security news page it is not yet mentioned.
> >>> Can anyone provide me with some information on this vulnerability and
> >>> SolR ?
> >>>
> >>> Thank you
> >>> --
> >>> Isabella Trevisan
> >>>
> >>
>
>
Re: Apache SolR and CVE-2023-44487
Posted by Jan Høydahl <ja...@cominvent.com>.
There is work in progress on a 8.11.3 release, which will include Jetty 9.4.53.v20231009 which also is not vulnearble.
Follow the dev-list for details on the progress of this release.
Jan
> 27. okt. 2023 kl. 10:32 skrev Isabella Trevisan <is...@infocamere.it.INVALID>:
>
> I read that version 9.4.0 mitigates this vulnerability but my version of
> solr is 8.11.2.
> Is there a workaround for version 8.11.2?
>
> Thank you
> Regards
> Isabella
>
>
> Il giorno ven 27 ott 2023 alle ore 10:16 Isabella Trevisan <
> isabella.trevisan@infocamere.it> ha scritto:
>
>> Sorry , I correct the CVE number CVE-2023-44487.
>>
>> Il giorno ven 27 ott 2023 alle ore 10:14 Isabella Trevisan <
>> isabella.trevisan@infocamere.it> ha scritto:
>>
>>> Hi,
>>> On October 10th, news of this vulnerability came out, which also
>>> affected SolR.
>>> On the Apache SolR Security news page it is not yet mentioned.
>>> Can anyone provide me with some information on this vulnerability and
>>> SolR ?
>>>
>>> Thank you
>>> --
>>> Isabella Trevisan
>>>
>>
Re: Apache SolR and CVE-2023-44487
Posted by Isabella Trevisan <is...@infocamere.it.INVALID>.
I read that version 9.4.0 mitigates this vulnerability but my version of
solr is 8.11.2.
Is there a workaround for version 8.11.2?
Thank you
Regards
Isabella
Il giorno ven 27 ott 2023 alle ore 10:16 Isabella Trevisan <
isabella.trevisan@infocamere.it> ha scritto:
> Sorry , I correct the CVE number CVE-2023-44487.
>
> Il giorno ven 27 ott 2023 alle ore 10:14 Isabella Trevisan <
> isabella.trevisan@infocamere.it> ha scritto:
>
>> Hi,
>> On October 10th, news of this vulnerability came out, which also
>> affected SolR.
>> On the Apache SolR Security news page it is not yet mentioned.
>> Can anyone provide me with some information on this vulnerability and
>> SolR ?
>>
>> Thank you
>> --
>> Isabella Trevisan
>>
>