SSRF vulnerability with the Replication handler (CVE-2021-27905)

Summary

SSRF vulnerability with the Replication handler

Original description

The description as published by the source.

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami solr

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.8.2"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2021-27905 lucene-solr Fixed in: 3.6.2+dfsg-23
Ubuntu UBUNTU-CVE-2021-27905 lucene-solr

Summary

Original description

Affected packages

Fix status by distribution

References