All errata/sisyphus_loongarch64/ALT-PU-2026-5548-1
ALT-PU-2026-5548-1

Package update lucene in branch sisyphus_loongarch64

Version10.4.0-alt1
Task#0
Published2026-03-31
Max severityHIGH
Severity:

Closed issues (5)

BDU:2024-09087
HIGH8.0

Уязвимость утилиты репликации файлов Lucene.Net.Replicator библиотеки полнотекстового поиска для платформы .NET Apache Lucene.Net, позволяющая нарушителю выполнить произвольный код и получить несанкционированный доступ к защищаемой информации

Published: 2024-11-07
CVSS 3.xHIGH 8.0
CVSS:3.x/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0HIGH 7.7
CVSS:2.0/AV:A/AC:L/Au:S/C:C/I:C/A:C
References
CVE-2024-43383
HIGH8.1

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue.

Published: 2024-10-31Modified: 2025-02-11
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2024-45772
HIGH8.0

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected. Users are recommended to upgrade to version 9.12.0, which fixes the issue. The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.

Published: 2024-09-30Modified: 2025-05-15
CVSS 3.xHIGH 8.0
CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-2qw8-ppr5-m96c
HIGH8.6

Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability

Published: 2024-10-31Modified: 2025-02-11
CVSS 3.xHIGH 8.6
CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0HIGH 8.6
CVSS:4.0/CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References