Package
solr-9-full
Component
commons-configuration2
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The vulnerable commons-configuration2 classes are shaded into the hadoop-client-runtime 3.4.3 jar that the hdfs module ships, so Solr's own constraint on commons-configuration2 (already 2.15.0) cannot replace them. Every published Hadoop release, including 3.5.0, still bundles commons-configuration2 2.10.1. Remediation requires a Hadoop release that bundles 2.15.0 or later and a Solr 9.x release that adopts it.
Status
Previous location
/usr/share/java/solr/modules/hdfs/lib/hadoop-client-runtime-3.4.1.jarNew location
/usr/share/java/solr/modules/hdfs/lib/hadoop-client-runtime-3.4.3.jarImpact
version-only path change detected during APK rebuild
Status