<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<h3>
Markus Koschany pushed to branch master
at <a href="https://salsa.debian.org/security-tracker-team/security-tracker">Debian Security Tracker / security-tracker</a>
</h3>
<h4>
Commits:
</h4>
<ul>
<li>
<strong><a href="https://salsa.debian.org/security-tracker-team/security-tracker/commit/e1aff2339d1af06e6d4dd92cef9057e6e263095c">e1aff233</a></strong>
<div>
<span>by Markus Koschany</span>
<i>at 2019-10-07T16:50:48Z</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CVE-2019-12401,lucene-solr: Mark as not-affected for Jessie
After investigating this issue I believe that the CVE should be reassigned to
libwoodstox-java but it does neither affect lucene-solr or the latter in Debian, so it is
not really important.
In Debian we use the system libraries. The oldest version of libwoodstox-java in
Jessie is 4.1.3. which was released in April 2012. CVE-2019-12401 probably
refers to the change in the 4.x series to disable coalescing mode by default
(it was erroneously set to true before).
Interesting article about java.xml.stream.isCoalescing can be found at
http://veithen.io/2013/10/11/broken-by-design-xlxp2.html
Otherwise there are only two other changes which may be related to the problem.
Since Buster even those are not relevant.
4.2.0 (23-Mar-2013)
New features:
* [WSTX-285], [WSTX-287]: Add ability to restrict certain size limits of parsed
XML
(updated using properties, see `ReaderConfig`)
4.2.1 (20-Mar-2014)
[WSTX-294]: Incorrect data returned from text containing CDATA when
IS_COALESCING property is set
(reported by Rafal Dabrowa)
The rest of the changes do not appear to be security relevant.
In order to exploit CVE-2019-12401 and to trigger OOM an attacker must be able to post documents
to the Solr instance. If he is able to do that he can easily cause a
denial-of-service by some means or other.
</pre>
</li>
</ul>
<h4>1 changed file:</h4>
<ul>
<li class="file-stats">
<a href="#4716ef5aa8f2742228ba3b3633215c8b808565e3">
data/CVE/list
</a>
</li>
</ul>
<h4>Changes:</h4>
<li id="4716ef5aa8f2742228ba3b3633215c8b808565e3">
<a href="https://salsa.debian.org/security-tracker-team/security-tracker/commit/e1aff2339d1af06e6d4dd92cef9057e6e263095c#4716ef5aa8f2742228ba3b3633215c8b808565e3"><strong>data/CVE/list</strong></a>
<hr>
No preview for this file type
<br>
</li>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777;">
—
<br>
<a href="https://salsa.debian.org/security-tracker-team/security-tracker/commit/e1aff2339d1af06e6d4dd92cef9057e6e263095c">View it on GitLab</a>.
<br>
You're receiving this email because of your account on salsa.debian.org.
If you'd like to receive fewer emails, you can
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Commit","url":"https://salsa.debian.org/security-tracker-team/security-tracker/commit/e1aff2339d1af06e6d4dd92cef9057e6e263095c"}}</script>
</p>
</div>
</body>
</html>