Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03Y3JjLXIzd2ctY2ZnZs4AA26r
Json response for search reveals Solr credentials
Impact
An error in Ibexa's Solr search engine results in potential exposure of Solr credentials. This is a critical vulnerability and all supported versions of the engine are affected. Those not using the Solr search engine are not affected.
Patches
The issue is fixed in all supported versions of ezsystems/ezplatform-solr-search-engine, see "Patched versions".
An advisory is also published for ibexa/solr, please see that repository.
Commit: https://github.com/ezsystems/ezplatform-solr-search-engine/commit/1005e02cc32ff15a705857fa56171528a83b9c3e
Workarounds
None.
References
Permalink: https://github.com/advisories/GHSA-7crc-r3wg-cfgfJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Y3JjLXIzd2ctY2ZnZs4AA26r
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 6 months ago
Updated: 6 months ago
Identifiers: GHSA-7crc-r3wg-cfgf
References:
- https://github.com/ezsystems/ezplatform-solr-search-engine/security/advisories/GHSA-7crc-r3wg-cfgf
- https://github.com/ezsystems/ezplatform-solr-search-engine/commit/c382037208f38f18efb5a6b21d6936efc55fc408
- https://github.com/advisories/GHSA-7crc-r3wg-cfgf
Blast Radius: 0.0
Affected Packages
packagist:ezsystems/ezplatform-solr-search-engine
Dependent packages: 24Dependent repositories: 89
Downloads: 933,719 total
Affected Version Ranges: >= 1.7.0, < 1.7.12, >= 2.0.0, < 2.0.2, >= 3.3.0, < 3.3.15
Fixed in: 1.7.12, 2.0.2, 3.3.15
All affected versions: 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.7.10, 1.7.11, 2.0.0, 2.0.1, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.3.10, 3.3.11, 3.3.12, 3.3.13, 3.3.14
All unaffected versions: 0.1.0, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.1.0, 1.1.1, 1.1.3, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.7, 1.5.8, 1.5.9, 1.6.0, 1.7.12, 2.0.2, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.2.1, 3.2.2, 3.3.15, 3.3.16