CVE-2024-45772CWE-502

Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue

Medium · published September 30, 2024

CVSS v3.1
5.1
EPSS
1%
Percentile
47.1
In the wild
Unconfirmed
What it is

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.

This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0.

The deprecated org.apache.lucene.replicator.http package is affected.

The org.apache.lucene.replicator.nrt package is not affected.

Users are recommended to upgrade to version 9.12.0, which fixes the issue.

The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00582 · 47.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-09-30T08:51Z
EPSS history
Timeline
  • 30 SEP 08:51Z
    Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue
    cvelistv5