[SOLR-13754] vulnerable derby-10.9.1.0.jar

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Assignee: Unassigned
• Reporter: Vijay Telu
• Created: 10/Sep/19 21:50
• Updated: 29/Aug/20 20:11
• Resolved: 29/Aug/20 20:11

Description

The Solr 7.7.2 and 8.2 having the the vulnerable derby-10.9.1.0.jar 

org.apache.solr-7.7.1/example/example-DIH/solr/db/lib/derby-10.9.1.0.jar

org.apache.solr-8.2.0/example/example-DIH/solr/db/lib/derby-10.9.1.0.jar

CVE-2015-1832
CVSSv3: 9.1

CVE-2018-1313
CVSSv3: 5.3

Issue Links

• is superceded by: SOLR-14783 Remove DIH from 9.0