[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Add CVE-2018-1308/lucene-solr

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8ea9fbfb by Salvatore Bonaccorso at 2018-04-08T21:30:48+02:00
Add CVE-2018-1308/lucene-solr

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -22668,8 +22668,14 @@ CVE-2018-1310
 	RESERVED
 CVE-2018-1309
 	RESERVED
-CVE-2018-1308
-	RESERVED
+CVE-2018-1308 [XXE attack through Apache Solr's DIH's dataConfig request parameter]
+	RESERVED
+	- lucene-solr <unfixed>
+	NOTE: http://www.openwall.com/lists/oss-security/2018/04/08/3
+	NOTE: https://issues.apache.org/jira/browse/SOLR-11971
+	NOTE: master: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/02c693f3
+	NOTE: branch_7x: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/739a7933
+	NOTE: branch_6_6: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/dd3be31f
 CVE-2018-1307 (In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java ...)
 	NOT-FOR-US: Apache juddi-client
 CVE-2018-1306



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/8ea9fbfbc0a5cb550b30ad5f116dfe98c14686a0

---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/8ea9fbfbc0a5cb550b30ad5f116dfe98c14686a0
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180408/888b68f2/attachment.html>