Advisories » MGASA-2017-0403

Updated lucene packages fix security vulnerability

Publication date: 06 Nov 2017
Modification date: 06 Nov 2017
Type: security
Affected Mageia releases : 6
CVE: CVE-2017-12629

Description

It was found that the CoreParser class in Lucene accepts doctype
declaration and expands external entities. An attacker could use this
flaw to bypass security restrictions and access sensitive data
(CVE-2017-12629).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=21976
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GTE5P6CWLVBPWNLR3RMLZGEFUYCZZR5V/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12629

SRPMS

6/core

• lucene-5.5.0-4.1.mga6