When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2     would forward/proxy distributed requests using server credentials instead of original client credentials.
    This would result in incorrect authorization resolution on the receiving hosts. (CVE-2021-29943)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2
    would forward/proxy distributed requests using server credentials instead of original client credentials.
    This would result in incorrect authorization resolution on the receiving hosts. (CVE-2021-29943)

The version of Apache Solr running on the remote host is 7.x prior to 7.7.4, or 8.x prior to 8.8.2. It is, therefore, affected by multiple vulnerabilities, including the following: 

  - The ReplicationHandler (normally registered at '/replication' under a Solr core) has a 'masterUrl' (also     'leaderUrl' alias) parameter that is used to designate another ReplicationHandler on another Solr core to     replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these     parameters against a similar configuration it uses for the 'shards' parameter. Prior to this bug getting     fixed, it did not. (CVE-2021-27905)

  - When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or     VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only     user is configured then Solr would not treat that node as a sensitive path and would allow it to be     readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not     automatically update the ACLs. (CVE-2021-29262)     
  - When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2     would forward/proxy distributed requests using server credentials instead of original client credentials.
    This would result in incorrect authorization resolution on the receiving hosts. (CVE-2021-29943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
255364	Linux Distros Unpatched Vulnerability : CVE-2021-29943	Nessus	Misc.	Local	critical
419287	SCA: security update for org.apache.solr:solr-parent (GHSA-vf7p-j8x6-xvwp)	Tenable Cloud Security	SCA Checks	Local	critical
419287	SCA: security update for org.apache.solr:solr-parent (GHSA-vf7p-j8x6-xvwp)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
181481	Apache Solr 7.x < 7.7.4 / 8.x < 8.8.2 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2021-29943

critical

Tenable Plugins

critical

critical

critical

critical