Approved changes feed: RSS · Atom
cpe:2.3:a:apache:lucene:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Lucene (e4e1a212-ea5c-519e-b363-6f0e3d3a02e5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/lucene |
purl2cpe | 2026-06-01 10:14:29.954102 |
pkg:github/apache/lucene |
purl2cpe | 2026-06-01 10:14:29.954104 |
pkg:maven/org.apache.lucene/lucene-core |
purl2cpe | 2026-06-01 10:14:29.954105 |
pkg:rpm/opensuse/lucene |
purl2cpe | 2026-06-01 10:14:29.954107 |
pkg:rpm/opensuse/lucene-core |
purl2cpe | 2026-06-01 10:14:29.954108 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-45772 |
vulnerable | 2026-06-08 06:48:09.017551 |
Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue
MEDIUM (5.1)
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.
This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0.
The deprecated org.apache.lucene.replicator.http package is affected.
The org.apache.lucene.replicator.nrt package is not affected.
Users are recommended to upgrade to version 9.12.0, which fixes the issue.
The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.
Published: 2024-09-30T08:51:30.950Z
Updated: 2024-12-12T16:22:31.991Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-43383 |
vulnerable | 2026-06-08 06:45:50.232744 |
Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator
HIGH (8)
Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator.
This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016.
An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access.
Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue.
Published: 2024-10-31T09:57:29.062Z
Updated: 2024-10-31T13:52:47.181Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.