Security Bulletin: Multiple vulnerabilities in Apache Solr (lucene) affect IBM InfoSphere Information Server

Summary

Multiple vulnerabilities in Apache Solr (lucene) were addressed by IBM InfoSphere Information Server.

Vulnerability Details

CVEID:CVE-2019-17558
**DESCRIPTION:**Apache Solr could allow a remote attacker to execute arbitrary code on the system. By providing a Velocity template through the VelocityResponseWriter, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173628 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

**Third Party Entry:**170845
**DESCRIPTION:**Apache Solr code execution
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/170845 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

InfoSphere Information Server,
InfoSphere Information Server on Cloud

| 11.7

Remediation/Fixes

Product | VRMF | APAR |

Remediation/First Fix

—|—|—|—
InfoSphere Information Server, Information Server on Cloud | 11.7 | JR61943 |

--Apply InfoSphere Information Server version 11.7.1.0
--Apply InfoSphere Information Server 11.7.1.0 Fix Pack 1
The issue is only applicable to environments that have a Microservices tier.

Workarounds and Mitigations

None