CVE-2017-12629

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-12629
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12629.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-12629
Aliases
Downstream
Related
Published
2017-10-14T23:29:00.260Z
Modified
2026-03-15T14:24:43.941362Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

References

Affected packages

Git / github.com/apache/lucene-solr

Affected ranges

Type
GIT
Repo
https://github.com/apache/lucene-solr
Events
Introduced
2a228b3920a07f930f7afb6a42d0d20e184a943c
Last affected
31012120ebbd93744753eb37f1dbc5e654628291
Introduced
48c80f91b8e5cd9b3a9b48e6184bd53e7619e7e3
Last affected
9aa465a89b64ff2dabe7b4d50c472de32c298683
Introduced
3ba304b29825a94249c5145b3f5061e87b87d8f8
Last affected
8d6c3889aa543954424d8ac1dbb3f03bf207140b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3ba304b29825a94249c5145b3f5061e87b87d8f8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
84c90ad2c0218156c840e19a64d72b8a38550659
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3ba304b29825a94249c5145b3f5061e87b87d8f8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2ae4746365c1ee72a0047ced7610b2096e438979
Database specific 
{
    "versions": [
        {
            "introduced": "5.5.0"
        },
        {
            "last_affected": "5.5.4"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "last_affected": "6.6.1"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.1.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/apache/solr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a4eb7aa123dc53f8dac74d80b66a490f2d6b4a26
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0"
        }
    ]
}

Affected versions

Other
grafts/lucene-oldest
grafts/lucene-solr-copy
grafts/lucene-solr-oldest-merged
grafts/solr-incubator-latest
grafts/solr-incubator-oldest
grafts/solr-latest
grafts/solr-oldest
history/branches/lucene-solr/LUCENE-5622
history/branches/lucene-solr/LUCENE2793
history/branches/lucene-solr/branch_7
history/branches/lucene-solr/cleanup2878
history/branches/lucene-solr/docvalues
history/branches/lucene-solr/jira/lucene-5438-nrt-replication
history/branches/lucene-solr/lucene-6835
history/branches/lucene-solr/lucene-6997
history/branches/lucene-solr/lucene/main
history/branches/lucene-solr/lucene2510
history/branches/lucene-solr/lucene2858
history/branches/lucene-solr/lucene3069
history/branches/lucene-solr/lucene3312
history/branches/lucene-solr/lucene3606
history/branches/lucene-solr/lucene3661
history/branches/lucene-solr/lucene3795_lsp_spatial_module
history/branches/lucene-solr/lucene3846
history/branches/lucene-solr/lucene3969
history/branches/lucene-solr/lucene4055
history/branches/lucene-solr/lucene4199
history/branches/lucene-solr/lucene4236
history/branches/lucene-solr/lucene4335
history/branches/lucene-solr/lucene4446
history/branches/lucene-solr/lucene4547
history/branches/lucene-solr/lucene4765
history/branches/lucene-solr/lucene5178
history/branches/lucene-solr/lucene5207
history/branches/lucene-solr/lucene5339
history/branches/lucene-solr/lucene539399
history/branches/lucene-solr/lucene5468
history/branches/lucene-solr/lucene5487
history/branches/lucene-solr/lucene5493
history/branches/lucene-solr/lucene5611
history/branches/lucene-solr/lucene5666
history/branches/lucene-solr/lucene5675
history/branches/lucene-solr/lucene5752
history/branches/lucene-solr/lucene5858
history/branches/lucene-solr/lucene5969
history/branches/lucene-solr/lucene5995
history/branches/lucene-solr/lucene6196
history/branches/lucene-solr/lucene6238
history/branches/lucene-solr/lucene6271
history/branches/lucene-solr/lucene6299
history/branches/lucene-solr/lucene6487
history/branches/lucene-solr/origin/branch_8_x
history/branches/lucene-solr/pforcodec_3892
history/branches/lucene-solr/pointvalues
history/branches/lucene-solr/preflexfixes
history/branches/lucene-solr/realtime_search
history/branches/lucene-solr/slowclosing
history/branches/lucene-solr/solr/main
history/branches/lucene-solr/solr2452
history/branches/lucene-solr/solr3733
history/branches/lucene-solr/solr5914
history/branches/lucene-solr/solr7787
releases/lucene-solr/5.*
releases/lucene-solr/5.5.0
releases/lucene-solr/5.5.1
releases/lucene-solr/5.5.2
releases/lucene-solr/5.5.3
releases/lucene-solr/5.5.4
releases/lucene-solr/7.*
releases/lucene-solr/7.0.0
releases/lucene-solr/7.0.1
releases/solr/9.*
releases/solr/9.0.0

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12629.json"