DEBIAN-CVE-2023-50291

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2023-50291
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-50291.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2023-50291
Upstream
Published
2024-02-09T18:15:08Z
Modified
2025-09-19T06:16:34Z
Summary
[none]
Details

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI. This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password". Users who cannot upgrade can also use the following Java system property to fix the issue:   '-Dsolr.redaction.system.pattern=.(password|secret|basicauth).'

References

Affected packages

Debian:11 / lucene-solr

Package

Name
lucene-solr
Purl
pkg:deb/debian/lucene-solr?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.2+dfsg-23

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / lucene-solr

Package

Name
lucene-solr
Purl
pkg:deb/debian/lucene-solr?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.2+dfsg-23

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / lucene-solr

Package

Name
lucene-solr
Purl
pkg:deb/debian/lucene-solr?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.2+dfsg-23

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / lucene-solr

Package

Name
lucene-solr
Purl
pkg:deb/debian/lucene-solr?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.2+dfsg-23

Ecosystem specific 

{
    "urgency": "not yet assigned"
}