CVE-2017-12629¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting an XML External Entity (XXE) flaw in the XML Query Parser, in conjunction with the Config API add-listener command to reach the RunExecutableListener class.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0
WSO2 JUSTIFICATION¶
Two Apache Lucene distributions are present in the product, and neither can carry this defect:
The in-range copy does not contain the vulnerable class. The Compass bundle shipped with the product embeds a pre-3.x Lucene distribution. The XXE described in this CVE lives in Lucene's XML query parser (org.apache.lucene.queryparser.xml.CoreParser), and that package is entirely absent from this copy.
The copy that contains the class is not in the affected range. The Lucene distribution nested inside the Solr bundle is a 9.x release, well beyond the <7.1.0 affected range, and includes the fix.
In addition, the Compass component is unused: no component in the shipped distribution references any org.compass class outside the Compass bundle itself. The RunExecutableListener half of this CVE is likewise unreachable, as Solr runs embedded in WSO2 Identity Server, exposes no HTTP endpoint and no Config API, and registry indexing is disabled by default in the shipped repository/conf/registry.xml.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.