In apache Solr the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions that uses the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin) Upstream bug: https://issues.apache.org/jira/browse/SOLR-12514 References: https://www.openwall.com/lists/oss-security/2019/04/24/1
Created solr3 tracking bugs for this issue: Affects: fedora-all [bug 1707548]
This vulnerability is out of security support scope for the following products: * Red Hat JBoss Fuse 6 * Red Hat JBoss Fuse Service Works 6 * Red Hat Enterprise Application Platform 6 * Red Hat JBoss Data Virtualization & Services 6 * Red Hat JBoss Data Grid 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
This vulnerability is out of security support scope for the following products: * JBoss Developer Studio 11 Please refer to https://access.redhat.com/node/4027141 for more details.
Statement: Red Hat Fuse 7 includes camel-solr to allow interfacing with Apache Lucene Solr clusters. This is only a client interface and is not affected by this vulnerability.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-11802