Все бюллетени/sisyphus_riscv64/ALT-PU-2026-5538-1
ALT-PU-2026-5538-1

Обновление пакета lucene в ветке sisyphus_riscv64

Версия10.4.0-alt1
Задание#0
Опубликовано2026-03-31
Макс. серьёзностьHIGH
Серьёзность:

Закрытые проблемы (5)

BDU:2024-09087
HIGH8.0

Уязвимость утилиты репликации файлов Lucene.Net.Replicator библиотеки полнотекстового поиска для платформы .NET Apache Lucene.Net, позволяющая нарушителю выполнить произвольный код и получить несанкционированный доступ к защищаемой информации

Опубликовано: 2024-11-07
CVSS 3.xВЫСОКАЯ 8.0
CVSS:3.x/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0ВЫСОКАЯ 7.7
CVSS:2.0/AV:A/AC:L/Au:S/C:C/I:C/A:C
Ссылки
CVE-2024-43383
HIGH8.1

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue.

Опубликовано: 2024-10-31Изменено: 2025-02-11
CVSS 3.xВЫСОКАЯ 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2024-45772
HIGH8.0

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected. Users are recommended to upgrade to version 9.12.0, which fixes the issue. The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.

Опубликовано: 2024-09-30Изменено: 2025-05-15
CVSS 3.xВЫСОКАЯ 8.0
CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
GHSA-2qw8-ppr5-m96c
HIGH8.6

Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability

Опубликовано: 2024-10-31Изменено: 2025-02-11
CVSS 3.xВЫСОКАЯ 8.6
CVSS:3.x/CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0ВЫСОКАЯ 8.6
CVSS:4.0/CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Ссылки