You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by us...@apache.org on 2024/09/30 15:29:20 UTC
(lucene) branch branch_10x updated: Add changes entries for CVE-2024-45772 and related commits
This is an automated email from the ASF dual-hosted git repository.
uschindler pushed a commit to branch branch_10x
in repository https://gitbox.apache.org/repos/asf/lucene.git
The following commit(s) were added to refs/heads/branch_10x by this push:
new c991212da06 Add changes entries for CVE-2024-45772 and related commits
c991212da06 is described below
commit c991212da063879dce273859b5864a250e8de059
Author: Uwe Schindler <us...@apache.org>
AuthorDate: Mon Sep 30 17:26:09 2024 +0200
Add changes entries for CVE-2024-45772 and related commits
---
lucene/CHANGES.txt | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/lucene/CHANGES.txt b/lucene/CHANGES.txt
index abcad073a73..bf7b99b159f 100644
--- a/lucene/CHANGES.txt
+++ b/lucene/CHANGES.txt
@@ -318,6 +318,12 @@ Build
======================== Lucene 9.12.0 =======================
+Security Fixes
+---------------------
+
+* Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator - CVE-2024-45772
+ (Summ3r from Vidar-Team, Robert Muir, Paul Irwin)
+
API Changes
---------------------
@@ -510,6 +516,8 @@ Other
* GITHUB#13720: Add float comparison based on unit of least precision and use it to stop test failures caused by float
summation not being associative in IEEE 754. (Alex Herbert, Stefan Vodita)
+* Remove code triggering forbidden-apis regarding Java serialization. (Uwe Schindler, Robert Muir)
+
======================== Lucene 9.11.1 =======================
Bug Fixes