You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by us...@apache.org on 2024/09/30 15:28:27 UTC
(lucene) branch branch_9_12 updated: Add changes entries for CVE-2024-45772 and related commits
This is an automated email from the ASF dual-hosted git repository.
uschindler pushed a commit to branch branch_9_12
in repository https://gitbox.apache.org/repos/asf/lucene.git
The following commit(s) were added to refs/heads/branch_9_12 by this push:
new 2da5a867d7a Add changes entries for CVE-2024-45772 and related commits
2da5a867d7a is described below
commit 2da5a867d7ac4db133800b1fae73bae5c4b7cf29
Author: Uwe Schindler <us...@apache.org>
AuthorDate: Mon Sep 30 17:26:09 2024 +0200
Add changes entries for CVE-2024-45772 and related commits
---
lucene/CHANGES.txt | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/lucene/CHANGES.txt b/lucene/CHANGES.txt
index 4097da1acf9..27468ecb15c 100644
--- a/lucene/CHANGES.txt
+++ b/lucene/CHANGES.txt
@@ -11,6 +11,12 @@ Bug Fixes
======================== Lucene 9.12.0 =======================
+Security Fixes
+---------------------
+
+* Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator - CVE-2024-45772
+ (Summ3r from Vidar-Team, Robert Muir, Paul Irwin)
+
API Changes
---------------------
@@ -216,6 +222,8 @@ Other
* GITHUB#13720: Add float comparison based on unit of least precision and use it to stop test failures caused by float
summation not being associative in IEEE 754. (Alex Herbert, Stefan Vodita)
+* Remove code triggering forbidden-apis regarding Java serialization. (Uwe Schindler, Robert Muir)
+
======================== Lucene 9.11.1 =======================
Bug Fixes