Bug 1789513 (CVE-2019-12401)

Summary:	CVE-2019-12401 solr: XML resource consumption attack via update handler
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, aileenc, asoldano, atangrin, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, drieden, extras-orphan, ggaughan, gvarsami, iweiss, janstey, jawilson, jcoleman, jochrist, jolee, jperkins, jschatte, jstastny, jwon, kconner, krathod, kwills, ldimaggi, lgao, msochure, msvehla, nwallace, pjindal, pmackay, psotirop, puntogil, rguimara, rsvoboda, rwagner, smaestri, tcunning, tkirby, tom.jenkinson, vhalbert
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	solr 5.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-01-09 20:09:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1789514
Bug Blocks:	1789515

Description Pedro Sampaio 2020-01-09 18:11:54 UTC

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it's update handler. By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.

Upstream issue:

https://issues.apache.org/jira/browse/SOLR-13750

Comment 1 Pedro Sampaio 2020-01-09 18:12:49 UTC

Created solr3 tracking bugs for this issue:

Affects: fedora-all [bug 1789514]

Comment 3 Product Security DevOps Team 2020-01-09 20:09:27 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-12401