[Git][java-team/lucene-solr][buster] Fix CVE-2019-0193

[Markus Koschany]

Markus Koschany pushed to branch buster at Debian Java Maintainers / lucene-solr


Commits:
01de5e72 by Markus Koschany at 2020-08-16T16:00:16+02:00
Fix CVE-2019-0193

- - - - -


3 changed files:

- debian/changelog
- + debian/patches/CVE-2019-0193.patch
- debian/patches/series


Changes:

=====================================
debian/changelog
=====================================
@@ -1,3 +1,19 @@
+lucene-solr (3.6.2+dfsg-20+deb10u2) buster; urgency=medium
+
+  * Team upload.
+  * Fix CVE-2019-0193:
+    The DataImportHandler, an optional but popular module to pull in data from
+    databases and other sources, has a feature in which the whole DIH
+    configuration can come from a request's "dataConfig" parameter. The debug
+    mode of the DIH admin screen uses this to allow convenient debugging /
+    development of a DIH config. Since a DIH config can contain scripts, this
+    parameter is a security risk. Starting from now on, use of this parameter
+    requires setting the Java System property "enable.dih.dataConfigParam" to
+    true. For example this can be achieved with solr-tomcat by adding
+    -Denable.dih.dataConfigParam=true to JAVA_OPTS in /etc/default/tomcat9.
+
+ -- Markus Koschany <apo at debian.org>  Sun, 16 Aug 2020 15:56:26 +0200
+
 lucene-solr (3.6.2+dfsg-20+deb10u1) buster; urgency=medium
 
   * Team upload.


=====================================
debian/patches/CVE-2019-0193.patch
=====================================
@@ -0,0 +1,70 @@
+From: Markus Koschany <apo at debian.org>
+Date: Sat, 15 Aug 2020 18:41:28 +0200
+Subject: CVE-2019-0193
+
+Bug-Upstream: https://issues.apache.org/jira/browse/SOLR-13669
+Origin: https://github.com/apache/lucene-solr/commit/325824cd391c8e71f36f17d687f52344e50e9715
+---
+ .../apache/solr/handler/dataimport/DataImportHandler.java   | 10 ++++++++++
+ .../dataimport/AbstractDataImportHandlerTestCase.java       | 13 ++++++-------
+ 2 files changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImportHandler.java b/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImportHandler.java
+index 9e11c79..a4a39a0 100644
+--- a/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImportHandler.java
++++ b/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImportHandler.java
+@@ -83,6 +83,10 @@ public class DataImportHandler extends RequestHandlerBase implements
+ 
+   private Map<String , Object> coreScopeSession = new HashMap<String, Object>();
+ 
++  static final String ENABLE_DIH_DATA_CONFIG_PARAM = "enable.dih.dataConfigParam";
++
++  final boolean dataConfigParam_enabled = Boolean.getBoolean(ENABLE_DIH_DATA_CONFIG_PARAM);
++
+   @Override
+   @SuppressWarnings("unchecked")
+   public void init(NamedList args) {
+@@ -153,6 +157,12 @@ public class DataImportHandler extends RequestHandlerBase implements
+       return;
+     }
+ 
++    if (dataConfigParam_enabled == false) {
++      throw new SolrException(SolrException.ErrorCode.FORBIDDEN,
++          "Use of the dataConfig param (DIH debug mode) requires the system property " +
++              ENABLE_DIH_DATA_CONFIG_PARAM + " because it's a security risk.");
++    }
++
+     rsp.add("initArgs", initArgs);
+     String message = "";
+ 
+diff --git a/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/AbstractDataImportHandlerTestCase.java b/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/AbstractDataImportHandlerTestCase.java
+index 1b49028..1cce926 100644
+--- a/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/AbstractDataImportHandlerTestCase.java
++++ b/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/AbstractDataImportHandlerTestCase.java
+@@ -30,7 +30,7 @@ import org.apache.solr.update.processor.UpdateRequestProcessor;
+ import org.apache.solr.update.processor.UpdateRequestProcessorFactory;
+ import org.apache.solr.common.util.NamedList;
+ import org.junit.After;
+-import org.junit.Before;
++import org.junit.BeforeClass;
+ 
+ import java.io.FileOutputStream;
+ import java.io.IOException;
+@@ -57,12 +57,11 @@ public abstract class AbstractDataImportHandlerTestCase extends
+   public static void initCore(String config, String schema) throws Exception {
+     initCore(config, schema, getFile("dih/solr").getAbsolutePath());
+   }
+-  
+-  @Override
+-  @Before
+-  public void setUp() throws Exception {
+-    super.setUp();
+-  }
++
++  @BeforeClass
++  public static void baseBeforeClass() {
++    System.setProperty(DataImportHandler.ENABLE_DIH_DATA_CONFIG_PARAM, "true");
++   }
+ 
+   @Override
+   @After


=====================================
debian/patches/series
=====================================
@@ -17,3 +17,4 @@ CVE-2017-3163.patch
 ant-1.10.patch
 CVE-2018-1308.patch
 web.xml.patch
+CVE-2019-0193.patch



View it on GitLab: https://salsa.debian.org/java-team/lucene-solr/-/commit/01de5e7250c46328157354162e13e51d51e2b712

-- 
View it on GitLab: https://salsa.debian.org/java-team/lucene-solr/-/commit/01de5e7250c46328157354162e13e51d51e2b712
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20200816/5bc10957/attachment.html>