Recommendation to update Apache POI in Apache Solr 4.8.0, 4.8.1, and 4.9.0 installations

{
  "id": "33219713c5e75a0820a3b4e017317a75b4e4ee3016be1de36c45659d64f2bd7f",
  "url": "https://solr.apache.org/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Recommendation to update Apache POI in Apache Solr 4.8.0, 4.8.1, and 4.9.0 installations",
    "summary": "Apache Solr users who enable Solr Cell are affected by vulnerabilities in bundled Apache POI. Users can disable Solr Cell or replace the vulnerable libraries with Apache POI 3.10.1 and Xmlbeans 2.6.0.",
    "evidence": "Alternatively, users of Apache Solr 4.8.0, 4.8.1, or 4.9.0 can update the affected libraries by replacing the vulnerable JAR files in the distribution folder.",
    "products": [
      {
        "name": {
          "value": "Apache Solr",
          "evidence": "Apache Solr versions 4.8.0, 4.8.1, 4.9.0 bundle Apache POI 3.10-beta2"
        },
        "prerequisites": [
          {
            "value": "enable the \"Apache Solr Content Extraction Library (Solr Cell)\" contrib module",
            "evidence": "Solr users are affected by these issues, if they enable the \"Apache Solr Content Extraction Library (Solr Cell)\" contrib module"
          }
        ],
        "fixed_versions": [
          {
            "value": "Apache POI 3.10.1",
            "evidence": "Download the Apache POI 3.10.1 binary release."
          }
        ],
        "affected_versions": [
          {
            "value": "4.8.0",
            "evidence": "Apache Solr versions 4.8.0, 4.8.1, 4.9.0 bundle Apache POI 3.10-beta2"
          },
          {
            "value": "4.8.1",
            "evidence": "Apache Solr versions 4.8.0, 4.8.1, 4.9.0 bundle Apache POI 3.10-beta2"
          },
          {
            "value": "4.9.0",
            "evidence": "Apache Solr versions 4.8.0, 4.8.1, 4.9.0 bundle Apache POI 3.10-beta2"
          }
        ]
      },
      {
        "name": {
          "value": "Apache POI",
          "evidence": "The Apache POI PMC released a bugfix version (3.10.1) today."
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.10.1",
            "evidence": "The Apache POI PMC released a bugfix version (3.10.1) today."
          }
        ],
        "affected_versions": [
          {
            "value": "3.10-beta2",
            "evidence": "Apache Solr versions 4.8.0, 4.8.1, 4.9.0 bundle Apache POI 3.10-beta2"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2014-3529",
        "evidence": "CVE-2014-3529: XML External Entity (XXE) problem in Apache POI's OpenXML parser"
      },
      {
        "value": "CVE-2014-3574",
        "evidence": "CVE-2014-3574: XML Entity Expansion (XEE) problem in Apache POI's OpenXML parser"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-apache-solr-security",
  "document_id": 23004,
  "published_at": "2014-08-18T00:00:00+00:00"
}