Bug 1692345 (CVE-2019-0192)

Summary:	CVE-2019-0192 solr: remote code execution due to unsafe deserialization
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, bmaxwell, cdewolf, chazlett, csutherl, darran.lofthouse, dimitris, dosoudil, fgavrilo, gvarsami, jawilson, jcoleman, jondruse, kconner, ldimaggi, lgao, myarboro, nwallace, pgier, ppalaga, psakar, pslavice, puntogil, rnetuka, rstancel, rsvoboda, rwagner, tcunning, tkirby, twalsh, vtunka
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Apache Solr's Config API, where it would permit the configuration of the JMX server via an HTTP POST request. An attacker could use this flaw to direct traffic to a malicious RMI server, and then trigger remote code execution or conduct further attacks.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-08 13:18:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1692346
Bug Blocks:	1692348

Description Dhananjay Arunesh 2019-03-25 12:25:06 UTC

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

Reference:
http://mail-archives.us.apache.org/mod_mbox/www-announce/201903.mbox/%3CCAECwjAV1buZwg%2BMcV9EAQ19MeAWztPVJYD4zGK8kQdADFYij1w%40mail.gmail.com%3E

Comment 1 Dhananjay Arunesh 2019-03-25 12:25:38 UTC

Created solr3 tracking bugs for this issue:

Affects: fedora-all [bug 1692346]

Comment 5 Jonathan Christison 2019-08-05 13:43:29 UTC

Mitigation:

* Upgrade to 6.6.6 or later
* Disable the ConifgAPI if not in use (`disable.configEdit=true`)
* Use other external means to ensure only trusted traffic is allowed (block POST requests to the config API from external sources)

Comment 6 errata-xmlrpc 2019-08-08 10:08:44 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.4.0

Via RHSA-2019:2413 https://access.redhat.com/errata/RHSA-2019:2413

Comment 7 Product Security DevOps Team 2019-08-08 13:18:37 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-0192