CVE-2019-17558

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-17558
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17558.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-17558
Aliases
Downstream
Related
Published
2019-12-30T17:15:19Z
Modified
2025-11-08T11:34:15Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is trusted (has been uploaded by an authenticated user).

References

Affected packages

Git / github.com/apache/solr

Affected ranges

Type
GIT
Repo
https://github.com/apache/solr
Events
Introduced
2ae4746365c1ee72a0047ced7610b2096e438979
Fixed
bc02ab906445fcf4e297f4ef00ab4a54fdd72ca2

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "322242177661752511937924035288649921527",
            "length": 328.0
        },
        "target": {
            "file": "lucene/core/src/java/org/apache/lucene/search/WANDScorer.java",
            "function": "updateMaxScoresIfNecessary"
        },
        "source": "https://github.com/apache/solr/commit/bc02ab906445fcf4e297f4ef00ab4a54fdd72ca2",
        "id": "CVE-2019-17558-1e10e06b",
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "10976882414751950059638941419805426406",
                "260795584727661223934841198029275441205",
                "216415124429699038245315793260080470919",
                "113103799677471152268327625975095285324",
                "310702034111532898610091903369918583712",
                "129694276526351264338253314871698247299",
                "232290896416728705449528819231863431097",
                "89102533218185564099916814835993664349",
                "88606249965852866247906205929793664521",
                "273521214631987130644931925530095859403",
                "224933079362674767285091952969036625369",
                "152900188039338513821490365627883143598",
                "271725351231511105376536441707262420576",
                "64775850617713722400768704247069873496",
                "244340295914217652509684822062533932710",
                "65166252091635503247965469955768007773",
                "226398673730486759669544059628531448018",
                "39124477276929361676344463950216212223",
                "2951874098677077266422638812207411270",
                "324638678557101068722981678526310048922",
                "124904179403201680304427297224929936643",
                "113587944783476531418173577044953778640",
                "243295425330906427916905801286067497753",
                "317625615714492643056792171813033081785",
                "173936996566032374848684447259902239194",
                "256534710829691687571498261740940689786"
            ]
        },
        "target": {
            "file": "lucene/core/src/java/org/apache/lucene/search/WANDScorer.java"
        },
        "source": "https://github.com/apache/solr/commit/bc02ab906445fcf4e297f4ef00ab4a54fdd72ca2",
        "id": "CVE-2019-17558-7cec5b5b",
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "244474418792315512363679098986362738814",
            "length": 471.0
        },
        "target": {
            "file": "lucene/core/src/java/org/apache/lucene/search/WANDScorer.java",
            "function": "moveToNextCandidate"
        },
        "source": "https://github.com/apache/solr/commit/bc02ab906445fcf4e297f4ef00ab4a54fdd72ca2",
        "id": "CVE-2019-17558-c6f2619b",
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "173751753590951628048193649735113508834",
            "length": 581.0
        },
        "target": {
            "file": "lucene/core/src/java/org/apache/lucene/search/WANDScorer.java",
            "function": "ensureConsistent"
        },
        "source": "https://github.com/apache/solr/commit/bc02ab906445fcf4e297f4ef00ab4a54fdd72ca2",
        "id": "CVE-2019-17558-f804c464",
        "deprecated": false,
        "signature_version": "v1"
    }
]

Git / github.com/apache/lucene-solr

Affected ranges

Type
GIT
Repo
https://github.com/apache/lucene-solr
Events
Introduced
859fdefbceb3ffe088e5091fd695380e81a49c11
Fixed
1a0d2a901dfec93676b0fe8be425101ceb754b85