Security Bulletin: IBM Operations Analytics - Log Analysis is affected by incorrect authorisation and XML external entity (XXE) vulnerabilities due to Apache Solr.

Summary Apache Solr is used by IBM Operations Analytics - Log Analysis as part of managing Solr collection and arbitary local file. CVE-2018-11802, CVE-2018-1308. Vulnerability Details CVEID:CVE-2018-11802 DESCRIPTION: In Apache Solr, the cluster can be partitioned into multiple collections and...

org.apache.carbondata:carbondata-datamap-examples (>=1.4.0, <=1.6.1), org.apache.carbondata:carbondata-examples (>=2.0.0, <=2.2.0) +10 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (6.3.0)

org.apache.solr:solr-core MAVEN version 6.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - org.apache.carbondata:carbondata-datamap-examples =1.4.0, =2.0.0, =1.6.0, =1.4.0, =2.0.0,...

com.github.jknack:mwa-solr4 (>=0.3.11, <=0.4.0), org.apache.jackrabbit:oak-solr-embedded (>=0.11, <=0.17.1) +11 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (4.1.0)

org.apache.solr:solr-core MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.github.jknack:mwa-solr4 =0.3.11, =0.11, =0.11, =0.17.1 - org.apache.solr:solr 4.1.0 -...

com.chenlb.mmseg4j:mmseg4j-for-solr40 (1.0.0), com.chenlb.mmseg4j:mmseg4j-solr (1.9.0) +25 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (4.0.0)

org.apache.solr:solr-core MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.chenlb.mmseg4j:mmseg4j-for-solr40 1.0.0 - com.chenlb.mmseg4j:mmseg4j-solr 1.9.0 -...

com.linkedin.zoie:zoie-solr (>=2.5.1, <=3.0.0), org.apache.solr:solr-clustering (1.4.0) +19 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (1.4.0)

org.apache.solr:solr-core MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.linkedin.zoie:zoie-solr =2.5.1, =3.2.0.cr1, =3.2.0.cr1, =5.3, =5.3, =1.2.0-m2, =1.2.0-m2, =1.2.0-m2,...

edu.cmu.lti.oaqa.core.provider:solr-provider (1.0.3), org.apache.directmemory:directmemory-solr (0.1-incubating) +20 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (3.6.0)

org.apache.solr:solr-core MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - edu.cmu.lti.oaqa.core.provider:solr-provider 1.0.3 - org.apache.directmemory:directmemory-solr 0.1-incubating...

com.github.jknack:mwa-solr3 (>=0.3.11, <=0.4.2), com.github.shyiko.rook:rook-target-hibernate4-fulltextindex (>=0.1.0, <=0.1.3) +39 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (3.6.2)

org.apache.solr:solr-core MAVEN version 3.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.github.jknack:mwa-solr3 =0.3.11, =0.1.0, =3.2.0, =4.0.0, =2.3.2, =2.3.2, =3.2.17, =3.2.23, =1.1.9, =1.1.1...

org.apache.polygene.extensions:org.apache.polygene.extension.indexing-solr (3.0.0), org.apache.solr.solr:solr-clustering (1.4.1) +7 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (1.4.1)

org.apache.solr:solr-core MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - org.apache.polygene.extensions:org.apache.polygene.extension.indexing-solr 3.0.0 -...

com.datasalt.pangool:pangool-core (>=0.40, <=0.43.3), com.datasalt.pangool:pangool-examples (>=0.40, <=0.43.3) +15 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (3.3.0)

org.apache.solr:solr-core MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.datasalt.pangool:pangool-core =0.40, =0.40, =3.0-rc2, =4.0.0.alpha1, =4.0.0.alpha1, =4.0.0.beta1 and more...

org.apache.solr:solr (4.0.0-beta), org.apache.solr:solr-analysis-extras (4.0.0-beta) +8 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (4.0.0-beta)

org.apache.solr:solr-core MAVEN version 4.0.0-beta is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - org.apache.solr:solr 4.0.0-beta - org.apache.solr:solr-analysis-extras 4.0.0-beta -...

com.chenlb.mmseg4j:mmseg4j-for-solr32 (1.0.0), org.apache.solr:solr (3.2.0) +23 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (3.2.0)

org.apache.solr:solr-core MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.chenlb.mmseg4j:mmseg4j-for-solr32 1.0.0 - org.apache.solr:solr 3.2.0 - org.apache.solr:solr-analysis-extr...

com.chenlb.mmseg4j:mmseg4j-all (1.8.6), com.chenlb.mmseg4j:mmseg4j-all-with-dic (1.8.6) +22 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (3.1.0)

org.apache.solr:solr-core MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.chenlb.mmseg4j:mmseg4j-all 1.8.6 - com.chenlb.mmseg4j:mmseg4j-all-with-dic 1.8.6 -...

ai.mattmann.mnemosyne:cas-crawler (1.11.0), ai.mattmann.mnemosyne:cas-filemgr (1.11.0) +26 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (1.3.0)

org.apache.solr:solr-core MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - ai.mattmann.mnemosyne:cas-crawler 1.11.0 - ai.mattmann.mnemosyne:cas-filemgr 1.11.0 -...

com.findwise.hydra:hydra-solr-in (>=0.3.1, <=0.4.5), com.google.code:lucene-gosen-ipadic (1.2.1) +20 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (3.4.0)

org.apache.solr:solr-core MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.findwise.hydra:hydra-solr-in =0.3.1, =1.9.0, =1.11.0, =4.0.0.beta2, =4.0.0.beta2, =4.0.0.final and more...

de.eonas.portal:opencmsinstaller (>=9.0.0.1, <=9.5.2.0), de.eonas.portal:opencmsportaldriver (>=9.5.1.0, <=9.5.2.0) +22 more potentially affected by CVE-2018-11802 via org.apache.solr:solr-core (4.3.0)

org.apache.solr:solr-core MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - de.eonas.portal:opencmsinstaller =9.0.0.1, =9.5.1.0, =9.0.1, =9.0.0, =9.0.1, =9.0.0, =9.0.1, =9.0.0, =9.0.0,...

Security Bulletin: Apache Solr vulnerability affects IBM Operations Analytics - Log Analysis (CVE-2018-11802)

Summary Remote attacker could bypass Apache Solr security restrictions Vulnerability Details CVEID: CVE-2018-11802 DESCRIPTION: Apache Solr could allow a remote attacker to bypass security restrictions, caused by an authorization bug. By sending a specially-crafted request, an attacker could...

CVE-2018-11802

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all...

CVE-2018-11802

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all...

CVE-2018-11802

CVE-2018-11802 involves Apache Solr authorization bypass: if a node receives a request for a collection it does not host, it proxies the request to a node that does host it, bypassing all authorization settings. This affects Solr versions prior to 7.7 that use the default RuleBasedAuthorizationPl...

CVE-2018-11802

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all...