CVE-2024-45772 MEDIUM

CVE-2024-45772: Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue

Vendor Apache Software Foundation
Product Apache Lucene Replicator
Weakness CWE-502 · Unsafe deserialization
Published September 30, 2024
Last update December 12, 2024
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Adjacent
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

Description

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected. Users are recommended to upgrade to version 9.12.0, which fixes the issue. The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.

Key dates

Disclosure timeline

September 30, 2024 CVE published
December 12, 2024 Record updated