svn commit: r919766 - in /websites/staging/lucene/trunk/content: ./ solr/solrnews.html

[bu...@apache.org]

Author: buildbot
Date: Tue Aug 19 00:06:29 2014
New Revision: 919766

Log:
Staging update by buildbot for lucene

Modified:
    websites/staging/lucene/trunk/content/   (props changed)
    websites/staging/lucene/trunk/content/solr/solrnews.html

Propchange: websites/staging/lucene/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Tue Aug 19 00:06:29 2014
@@ -1 +1 @@
-1618767
+1618768

Modified: websites/staging/lucene/trunk/content/solr/solrnews.html
==============================================================================
--- websites/staging/lucene/trunk/content/solr/solrnews.html (original)
+++ websites/staging/lucene/trunk/content/solr/solrnews.html Tue Aug 19 00:06:29 2014
@@ -239,17 +239,24 @@
       <div><h1 id="solrwzxhzdk0tmwzxhzdk1-news">Solr<span style="vertical-align: super; font-size: xx-small">TM</span> News</h1>
 <h2 id="18-august-2014-recommendation-to-update-apache-poi-in-apache-solr-480-481-and-490-installations">18 August 2014 - Recommendation to update Apache POI in Apache Solr 4.8.0, 4.8.1, and 4.9.0 installations</h2>
 <p>Apache Solr versions 4.8.0, 4.8.1, 4.9.0 bundle Apache POI 3.10-beta2 with its binary release tarball.
-This version (and all previous ones) of Apache POI are vulnerable to the following issues:
-CVE-2014-3529 <em>(XML External Entity (XXE) problem in Apache POI's OpenXML parser)</em>, 
-CVE-2014-3574 <em>(XML Entity Expansion (XEE) problem in Apache POI's OpenXML parser)</em>.</p>
-<p>The Apache POI PMC released a bugfix version (3.10.1) today.</p>
+This version (and all previous ones) of Apache POI are vulnerable to the following issues:</p>
+<h3 id="cve-2014-3529-xml-external-entity-xxe-problem-in-apache-pois-openxml-parser">CVE-2014-3529: XML External Entity (XXE) problem in Apache POI's OpenXML parser</h3>
+<p><em>Information disclosure:</em> Apache POI uses Java's XML components to parse OpenXML files produced by Microsoft Office products (DOCX, XLSX, PPTX,...).
+Applications that accept such files from end-users are vulnerable to XML External Entity (XXE) attacks, which allows remote attackers to bypass
+security restrictions and read arbitrary files via a crafted OpenXML document that provides an XML external entity declaration in conjunction
+with an entity reference.</p>
+<h3 id="cve-2014-3574-xml-entity-expansion-xee-problem-in-apache-pois-openxml-parser">CVE-2014-3574: XML Entity Expansion (XEE) problem in Apache POI's OpenXML parser</h3>
+<p><em>Denial of service:</em> Apache POI uses Java's XML components and Apache Xmlbeans to parse OpenXML files produced by Microsoft Office products
+(DOCX, XLSX, PPTX,...). Applications that accept such files from end-users are vulnerable to XML Entity Expansion (XEE) attacks ("XML bombs"),
+which allows remote hackers to consume large amounts of CPU resources.</p>
+<p><strong>The Apache POI PMC released a bugfix version (3.10.1) today.</strong></p>
 <p>Solr users are affected by these issues, if they enable the "Apache Solr Content Extraction Library (Solr Cell)"
 contrib module from the folder "contrib/extraction" of the release tarball.</p>
 <p>Users of Apache Solr are strongly advised to keep the module disabled if they don't use it.
 Alternatively, users of Apache Solr 4.8.0, 4.8.1, or 4.9.0 can update the affected libraries by
 replacing the vulnerable JAR files in the distribution folder. Users of previous versions have
 to update their Solr release first, patching older versions is impossible.</p>
-<p><strong>To replace the vulnerable JAR files follow these steps:</strong></p>
+<h3 id="to-replace-the-vulnerable-jar-files-follow-these-steps">To replace the vulnerable JAR files follow these steps:</h3>
 <ul>
 <li>
 <p>Download the <a href="http://poi.apache.org/download.html#POI-3.10.1">Apache POI 3.10.1</a> binary release.</p>