Reporting

Do you want disclose a potential security issue for Apache Lucene? Send your report to the Apache Lucene Security Team.

Advisories

This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org

Security Vulnerability in Lucene Replicator - Deserialization Issue

CVE-2024-45772 [CVE] [CVE json] [OSV json]

Last updated: 2024-12-10T17:34:29.725Z

Affected

• Apache Lucene Replicator from 4.4.0 before 9.12.0

Description

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.

This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0.
The deprecated org.apache.lucene.replicator.http package is affected.
The org.apache.lucene.replicator.nrt package is not affected.

Users are recommended to upgrade to version 9.12.0, which fixes the issue.

The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.

References

• https://lists.apache.org/thread/3f3oph7bqnqspb9q5p0gm5mgc1b6thjo

Credits

• Summ3r from Vidar-Team (finder)
• Paul Irwin from Apache Lucene.NET (coordinator)