inteligr8/SearchServices
1
0
Fork 0
mirror of https://github.com/Alfresco/SearchServices.git synced 2026-09-16 18:12:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2273 from Alfresco/fix/ACS-12426-cve-vulnerabilities-in-insight-engine-2

Browse Source 
[ACS-124126] CVE Vulnerabilities in Insight Engine 2
This commit is contained in:
Adam Decatur
2026-08-18 08:38:03 -05:00
committed by GitHub
parent ded8e6edf8 1668676b41
commit 19bc6dcb47
3 changed files with 54 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pom.xml
+1 -1
View File
@@ -95,7 +95,7 @@
<dependency.commons-fileupload.version>1.6.0</dependency.commons-fileupload.version>
<dependency.commons-io.version>2.15.1</dependency.commons-io.version>
<dependency.commons-codec.version>1.16.1</dependency.commons-codec.version>
<dependency.spring.version>7.0.7</dependency.spring.version>
<dependency.spring.version>7.0.8</dependency.spring.version>
<dependency.spring-e2e-test.version>5.3.39</dependency.spring-e2e-test.version>
<dependency.zookeeper.version>3.4.14</dependency.zookeeper.version>
<dependency.mime4j.version>0.8.11</dependency.mime4j.version>
search-services/SECURITY-MITIGATIONS.md
+48
View File
@@ -0,0 +1,48 @@
# Jetty 9.4.57 CVE Mitigations
## Scope
Search Services embeds the `solr-solr-6.6.5-patched.22.zip` runtime. That ZIP
contains Jetty `9.4.57.v20241219` JARs under `server/lib`; Maven dependency
management does not replace them in the packaged distribution.
This assessment applies to the default runtime assembled by
`search-services/packaging/pom.xml`. Reassess it when the Solr distribution,
Jetty configuration, ingress, or authentication mode changes.
## Reachability Assessment
| CVE | Disposition | Evidence |
| --- | --- | --- |
| CVE-2026-6790 | Not reachable | Requires HTTP/2 or HTTP/3. The distribution contains no HTTP/2, HTTP/3, or ALPN JARs. `server/etc/jetty-http.xml` configures only Jetty's HTTP/1.1 `HttpConnectionFactory`. |
| CVE-2024-6763 | Not applicable to current use | Requires application use of `org.eclipse.jetty.http.HttpURI` as a validator for attacker-controlled URLs. Repository application code does not reference that class, and the Jetty advisory states that normal server use is not vulnerable. |
| CVE-2025-11143 | Not exploitable through identified application code | Repository application code does not use `HttpURI` for URL allowlists/blocklists, redirects, host ACLs, or SSRF protection. Reject malformed URIs at the ingress as defense in depth. |
| CVE-2026-10050 | Not reachable | The vulnerable class is client-side `org.eclipse.jetty.client.DigestAuthentication`. The distribution contains no `jetty-client` JAR. The server-side `DigestAuthenticator` is a different class and is not configured. |
| CVE-2026-2332 | Reachable unless controlled at deployment | The vulnerable HTTP/1.1 chunk parser is active in `HttpConnectionFactory` and processes requests before Solr authentication. Application-level shared-secret checks do not prevent parser exploitation. |
## Required Controls for CVE-2026-2332
Production deployments must apply all applicable controls below:
1. Do not expose the Solr listener directly to public or general internal networks.
2. Restrict port `8983` to approved ACS, Search, monitoring, and administrative sources using network policy, firewall rules, or security groups.
3. Prefer mutual TLS and set `SOLR_SSL_NEED_CLIENT_AUTH=true`.
4. At any ingress proxy, reject malformed chunked transfer encoding, chunk extensions, and control characters in chunk metadata. Prefer normalized upstream requests using `Content-Length`.
5. Do not rely on `ALFRESCO_SECURE_COMMS=secret` alone. Jetty parses HTTP framing before the shared-secret authentication plugin runs.
6. Do not use `ALFRESCO_SECURE_COMMS=none` in production.
## Deployment Evidence
Capture the following evidence for each deployed environment before accepting
the mitigation:
- The effective `ALFRESCO_SECURE_COMMS` value.
- The effective `SOLR_SSL_NEED_CLIENT_AUTH` value.
- Listener bindings and published container ports.
- Firewall, security-group, or network-policy rules protecting port `8983`.
- Ingress or load-balancer rules for chunked transfer encoding and connection reuse.
- A request-path diagram showing every component between an untrusted client and Jetty.
Reopen the finding if untrusted clients can establish a direct HTTP/1.1
connection to Jetty, or if the ingress cannot reject the malformed chunked
requests described by CVE-2026-2332.
search-services/packaging/src/main/resources/licenses/notice.txt
+5 -5
View File
@@ -64,11 +64,11 @@ jackson-core-2.22.1.jar https://github.com/FasterXML/jackson
jackson-annotations-2.22.jar https://github.com/FasterXML/jackson
jackson-databind-2.22.1.jar https://github.com/FasterXML/jackson
commons-httpclient-3.1-HTTPCLIENT-1265.jar http://jakarta.apache.org/commons/
spring-beans-7.0.7.jar http://projects.spring.io/spring-framework/
spring-context-7.0.7.jar http://projects.spring.io/spring-framework/
spring-core-7.0.7.jar http://projects.spring.io/spring-framework/
spring-expression-7.0.7.jar http://projects.spring.io/spring-framework/
spring-tx-7.0.7.jar http://projects.spring.io/spring-framework/
spring-beans-7.0.8.jar http://projects.spring.io/spring-framework/
spring-context-7.0.8.jar http://projects.spring.io/spring-framework/
spring-core-7.0.8.jar http://projects.spring.io/spring-framework/
spring-expression-7.0.8.jar http://projects.spring.io/spring-framework/
spring-tx-7.0.8.jar http://projects.spring.io/spring-framework/
guessencoding-1.4.jar http://docs.codehaus.org/display/GUESSENC/
jug-2.0.0-asl.jar http://jug.safehaus.org/
acegi-security-0.8.2_patched.jar http://sourceforge.net/projects/acegisecurity/