1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-JQ2W-W7V2-69Q5

[MAVEN:GHSA-JQ2W-W7V2-69Q5] Apache Solr vulnerable to XML Bomb

Severity High
Affected Packages 1
Fixed Packages 1
CVEs 1
Info Packages References Vulnerabilities

Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it?s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.

Package Affected Version
pkg:maven/org.apache.solr/solr-core < 5.0.0
Package Fixed Version
pkg:maven/org.apache.solr/solr-core = 5.0.0
ID
MAVEN:GHSA-JQ2W-W7V2-69Q5
Severity
high
URL
https://github.com/advisories/GHSA-jq2w-w7v2-69q5
Published
2022-05-24T22:00:29
(2 years ago)
Modified
2023-03-14T05:06:34
(18 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.apache.solr/solr-core org.apache.solr solr-core < 5.0.0
Fixed pkg:maven/org.apache.solr/solr-core org.apache.solr solr-core = 5.0.0
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date