UBUNTU-CVE-2021-27905

    Dashboard / Vulnerabilities / UBUNTU-CVE-2021-27905

    UBUNTU-CVE-2021-27905

    Published: 13 Apr 2021Last Modified: 20 May 2026
    Upstream:
    CVE-2021-27905

    Summary:

    Details: The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

    References: https://ubuntu.com/security/CVE-2021-27905, https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E, https://www.cve.org/CVERecord?id=CVE-2021-27905

    Affected packages

    Package

    Name: lucene-solr

    Purl: pkg:deb/ubuntu/lucene-solr?arch=source&distro=esm-infra-legacy%2Ftrusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    3.6.2+dfsg-1
    3.6.2+dfsg-2
    3.6.2+dfsg-2ubuntu0.1~esm1
    3.6.2+dfsg-2ubuntu0.1~esm2
    3.6.2+dfsg-2ubuntu0.1~esm4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2021-27905 | CVE-DB