[SOLR-13208] Update dom4j in solr package due to security vulnerability

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 7.6, 8.0
• Component/s: Server
• Assignee: Unassigned
• Reporter: DW
• Created: 31/Jan/19 15:05
• Updated: 08/Jun/19 14:58
• Resolved: 22/Mar/19 19:14

Description

The Solr package contains dom4j-1.6.1 in the server webapp component in server/solr-webapp/webapp/WEB-INF/lib/dom4j-1.6.1.jar

Please can you upgrade dom4j-1.6.1 due to open security vulnerability to 2.1.1+.

If you need the CVE number, let me know.

 

Issue Links

• duplicates: SOLR-13113 CVE-2018-1000632 Threat Level 7 Against Solr v7.6. dom4j : dom4j : 1.6.1. dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute ...
• is related to: SOLR-13342 Remove dom4j from Solr