CVE catalog
CVE-2017-9803
lucene-solr: CVE-2017-9803
- Severity
- High · CVSS 8.1
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.19% · Oct 27, 2026
Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | lucene-solr | sid | 3.6.2+dfsg-28 | not affected |
| Debian | lucene-solr | forky | 3.6.2+dfsg-28 | not affected |
| Debian | lucene-solr | trixie | 3.6.2+dfsg-26 | not affected |
| Debian | lucene-solr | bookworm | 3.6.2+dfsg-26 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | lucene-solr | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | lucene-solr | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | lucene-solr | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | lucene-solr | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [liblucene3-contrib-java]Not affected
Source package: [lucene-solr]
Details (2)
3.6.2+dfsg-26· all · bookwormNot affected
dsa · lucene-solr · debian · bookworm
3.6.2+dfsg-26· all · bookwormNot affected
dsa · lucene-solr · debian · bookworm
- [liblucene3-java]Not affected
Source package: [lucene-solr]
Details (2)
3.6.2+dfsg-26· all · bookwormNot affected
dsa · lucene-solr · debian · bookworm
3.6.2+dfsg-26· all · bookwormNot affected
dsa · lucene-solr · debian · bookworm
Observed: