You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@lucene.apache.org by us...@apache.org on 2014/09/10 11:10:23 UTC

svn commit: r1623945 - /lucene/board-reports/2014/board-report-september.txt

Author: uschindler
Date: Wed Sep 10 09:10:23 2014
New Revision: 1623945

URL: http://svn.apache.org/r1623945
Log:
Add security to board report

Modified:
    lucene/board-reports/2014/board-report-september.txt

Modified: lucene/board-reports/2014/board-report-september.txt
URL: http://svn.apache.org/viewvc/lucene/board-reports/2014/board-report-september.txt?rev=1623945&r1=1623944&r2=1623945&view=diff
==============================================================================
--- lucene/board-reports/2014/board-report-september.txt (original)
+++ lucene/board-reports/2014/board-report-september.txt Wed Sep 10 09:10:23 2014
@@ -30,7 +30,19 @@ as PDF version, generated from the Confl
 
 The community is very active.
 
-Security: TBD
+Security: There were two security issues reported:
+
+ - An XXE vulnerability was reported against Apache Solr
+   (CVE-2014-3529). The issue was caused by the bundled Apache
+   POI library. Apache POI fixed the issue and released
+   bugfix packages. An advisory was posted on the Solr web page
+   about how to update the bundled libraries in existing
+   deployments. The recent release of Apache Solr 4.10.0 is no
+   longer vulnerable.
+ - External search web pages, referenced by the Lucene/Solr
+   site, were vulnerable to an XSS attack. Both providers,
+   Lucid Imagination and Sematext, were contacted and they
+   fixed the problem.
 
 
 PyLucene