Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.lucene:lucene-replicator

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1MavenPublished

    Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.

    CVE-2024-45772 · GHSA-g643-xq6w-r67c

    Affected
    • Maven org.apache.lucene:lucene-replicator >= 4.4.0, < 9.12.0
    Fixed in
    9.12.0· Vendor fix available
    Issue
    This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected. Users are recommended to upgrade to version 9.12.0, which fixes the issue. The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.

    Recommended action: Upgrade to 9.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →