[Solr Wiki] Update of "SolrSecurity" by CassandraTargett

[Apache Wiki <wi...@apache.org>]

Dear Wiki user,

You have subscribed to a wiki page or wiki category on "Solr Wiki" for change notification.

The "SolrSecurity" page has been changed by CassandraTargett:
https://wiki.apache.org/solr/SolrSecurity?action=diff&rev1=51&rev2=52

Comment:
First pass at adding known CVEs that are not a problem for Solr

  
  For reasons not related to security, it is strongly recommended that this contrib module is never used in production.  Tika can crash, and if such a crash happens in the SolrCell module, Solr will crash too.  If that advice is followed, it would be very difficult to utilize Tika vulnerabilities to compromise Solr.
  
+ == Solr and Vulnerability Scanning Tools ==
+ 
+ Many organizations have policies where software to be installed on the network must pass an examination by a vulnerability scanner which attempts to determine if there are known vulnerabilities in the application.
+ 
+ Solr includes many dependencies which may trigger warnings from a vulnerability scan but which the Lucene/Solr community has determined that they are false positives. As a general rule, the Lucene PMC will not accept the output of a vulnerability scan as a security report.
+ 
+ The following table lists the dependencies and associated CVEs which are not considered problems for Lucene or Solr.
+ 
+ ||<style="font-weight: bold;">Solr Versions||<style="font-weight: bold;">Jar or Path||<style="font-weight: bold;">Related CVEs||<style="font-weight: bold;">Date Added||<style="font-weight: bold;">Status & Notes||
+ || 7.3.1 || `tika-core.1.17.jar` || 2018-1335  || 6 Jun 2018 || Solr does not run tika-server, so this is not a problem.||
+ || 7.3.1 || `tika-core.1.17.jar` || 2018-1338 & 2018-1339 || 6 Jun 2018 || These issues would only be exploitable if untrusted files are indexed with SolrCell. This is not recommended in production systems as indicated above. Additionally, Solr upgraded to Tika 1.18 in Solr 7.4. ||
+ || 7.3.1 || `jackson-databind-2.5.4.jar` || Several: 2017-15095, 2017-17485, 2017-7525, 2018-5968, 2018-7489 || 6 Jun 2018 || Jackson was upgraded to 2.9.5 in Solr 7.4.||
+ || 7.3.1 || `lucene-analyzers-icu-7.3.1.jar` || Several: 2014-7940, 2016-6293, 2016-7415, 2017-14952, 2017-17484, 2017-7867, 2017-7868 || 6 Jun 2018 || All of these issues apply to the C++ release of ICU and not ICU4J, which is what Lucene uses. ||
+ || 7.3.1 || `icu4j-59.1.jar` || 2017-14952 || 6 Jun 2018 || Issue applies only to the C++ release of ICU and not ICU4J, which is what Lucene uses. ||
+ || 7.3.1 || `hadoop-auth-2.7.4.jar` || 2017-15718 || 6 Jun 2018 || Does not affect Solr because Solr uses Hadoop as a client library. ||
+ || 7.3.1 || `commons-beanutils-1.8.3.jar` || 2014-0114 || 6 Jun 2018 || ||
+ || 7.3.1 || `vorbis-java-tika-0.8.jar` || Several: 2016-6809, 2018-1335, 2018-1338, 2018-1339 || 6 Jun 2018|| ||
+ || 7.3.1 || `xercesImpl-2.9.1.jar` || 2012-0881 || 6 Jun 2018 || ||
+ || 7.3.1 || Several dependencies of ZooKeeper 3.4.12: `api-ldap-codec-standalone:1.0.0-M20`, `api-ldap-extras-aci:1.0.0-M20`, `api-ldap-extras-sp:1.0.0-M20`, `api-ldap-extras-trigger:1.0.0-M20`, `api-ldap-extras-util:1.0.0-M20`, `api-ldap-net-mina:1.0.0-M20`, `api-ldap-schema-converter:1.0.0-M20`, `api-util:1.0.0-M20` ||6 Jun 2018 || ||
+