Apache Solr security advisory: CVE-2017-12629

{
  "id": "f5fefc0eddf6711ad9ab2821a3652f323b017c2584ccaa06affecfe0d06c5bec",
  "url": "https://solr.apache.org/solr-security-please-secure-your-apache-solr-servers-since-a-zero-day-exploit-has-been-reported-on-a-public-mailing-list.html",
  "method": "llm",
  "payload": {
    "kind": "advisory",
    "title": "Apache Solr security advisory: CVE-2017-12629",
    "summary": "Apache Solr users are advised to disable Config API edits and remap the XML Query Parser as mitigations. The RunExecutableListener removal and XML Parser fix are planned for 7.1; no fixed release is available in this announcement.",
    "evidence": "Until fixes are available, all Solr users are advised to restart their Solr instances with the system property -Ddisable.configEdit=true.",
    "products": [
      {
        "name": {
          "value": "Apache Solr",
          "evidence": "Please secure your Apache Solr servers since a zero-day exploit has been reported on a public mailing list"
        },
        "prerequisites": [
          {
            "value": "restart their Solr instances with the system property -Ddisable.configEdit=true",
            "evidence": "all Solr users are advised to restart their Solr instances with the system property -Ddisable.configEdit=true"
          },
          {
            "value": "remap the XML Query Parser to another parser",
            "evidence": "Users are also advised to remap the XML Query Parser to another parser to mitigate the XXE vulnerability"
          }
        ],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2017-12629",
        "evidence": "This has been assigned a public CVE (CVE-2017-12629)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-apache-solr-security",
  "document_id": 23000,
  "published_at": "2017-10-12T00:00:00+00:00"
}