==========================================================================
Ubuntu Security Notice USN-4259-1
January 29, 2020

Apache Solr vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 16.04 LTS

Summary:

Apache Solr could be made to run programs if it received
specially crafted network traffic.

Software Description:
– lucene-solr: Full-text search engine library for Java – additional libraries

Details:

Michael Stepankin and Olga Barinova discovered that Apache Solr was
vulnerable to an XXE attack. An attacker could use this vulnerability to
remotely execute code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
liblucene3-contrib-java 3.6.2+dfsg-8ubuntu0.1
liblucene3-java 3.6.2+dfsg-8ubuntu0.1
libsolr-java 3.6.2+dfsg-8ubuntu0.1
solr-common 3.6.2+dfsg-8ubuntu0.1
solr-jetty 3.6.2+dfsg-8ubuntu0.1
solr-tomcat 3.6.2+dfsg-8ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4259-1
CVE-2017-12629

Package Information:
https://launchpad.net/ubuntu/+source/lucene-solr/3.6.2+dfsg-8ubuntu0.1

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEwZbe96kJeWh2OITRdyg1Qz0oXX0FAl4xvJgACgkQdyg1Qz0o
XX04Yg//cqQrVfBZhS/7NvpbkfkmQ4W3RY674oM3BVpnEbRowrSSTq49qJfBaml7
x8H82ffyX+vvTmuFzL7jTBERqYPC8hJT1MRwuW50dmlfmRFuJPdcdxfreJee0OD4
5IsLn0SyJoR5L+yTUEjGr8n2Em9cq/+bdxXpWVATkQkdgOqt80ccuTkxKfMo3waM
BuLEUD2/cwHqpGsI+4QlsKGlg6sDLWCY2w/dmkUvQgWM6vp5HUPNpMKvH7Z7CSLa
8iZsVD3LoVhaXrH/9kTVB6TSagvHx3KZDf/gufAtHNvpV0vetQHJrEJPlCRusIy4
MeAbYrl55ztel+yVgErjNKxnRbqGPJo4U0s6fMTRYLeAI4RmscGcBjDFdBoHbSUF
cGFAd+AvY4jQG4i40qf46DF/C61/HtFcP0y+kelCqApfUUBuSgSBa7rhV09LBQbE
xifLwXEUyi4rmHh9g8iwHi4z1/2g5Z3bTZ/zKzGlovzvIvfNG78RFTZQBc17s0ug
qOFEOP7az+mX1F6vZASEkNOVGRMo/8buSmJeX+lbha4pQz3fCsecsGq+zHW3iXVw
q5m+v8f56Ma/SkHcFuOlLuBVDCoB3pikKRO0HHlDTBCjpfW+gk4ItqmR2W6JjNmk
9kk8DI2CYPAKLktvru8MWUMH4jCcNNIb5MV0twYQXVSwfzl7lXI=
=EyQJ
—–END PGP SIGNATURE—–
—