Skip to content

Commit 7a62f65

Browse files
dkd-kaehmdkd-kaehm
committed
!!![SECURITY] Update to Apache solr 9.8.0 : CVE-2025-24814
Updates EXT:solr to Apache Solr 9.8.0. Apache Solr 9.8.0 disables the possibility to load the `jar` files with `lib` directive by default, which was used to load jar files within the EXT:solr configsets. Apache Solr 10.0.0 will drop that functionality. All Apache Solr libs, modules or plugins must be configured within the main server configuration files. See: https://issues.apache.org/jira/browse/SOLR-16781 By using our official Docker image from https://hub.docker.com/r/typo3solr/ext-solr, you want to pull the image v. 12.0.6+ and restart the container with that image, which will run a migrationsscript automatically to secure the configuration in used volume automatically. No other steps are required. Alternatively you can wipe the volume and start the container with v. 12.0.6+ image, but that method will wipe the index as well. See the script `EXT:solr/Docker/SolrServer/docker-entrypoint-initdb.d/as-sudo/fix-CVE-2025-24814.sh` You have 2 possibilities to fix that issue in your Apache Solr Server: Refer to https://github.com/TYPO3-Solr/ext-solr/pull/4292/files . Following 3 files are relevant: * Changes in `<Apache-Solr data dir>/configsets/ext_solr_13_0_0/conf/solrconfig.xml` * Changes in `<Apache-Solr data dir>/solr.xml` * Movement from `<Apache-Solr data dir>/configsets/ext_solr_13_0_0/typo3lib/solr-typo3-plugin-6.0.0.jar` * to `<Apache-Solr data dir>/typo3lib/solr-typo3-plugin-6.0.0.jar` Steps: 1. Remove all occurrences of `<lib dir=".*` from `Resources/Private/Solr/configsets/ext_solr_13_0_0/conf/solrconfig.xml` file. 2. Replace in `Resources/Private/Solr/solr.xml` file the snipped `<str name="modules">scripting</str>` by ``` <str name="modules">scripting,analytics,analysis-extras,langid,clustering,extraction,${solr.modules:}</str> <str name="allowPaths">${solr.allowPaths:}</str> <str name="allowUrls">${solr.allowUrls:}</str> <!-- TYPO3 Plugins --> <str name="sharedLib">/var/solr/data/typo3lib/</str> ``` 3. Move the directory from `<Apache-Solr data dir>/configsets/ext_solr_13_0_0/typo3lib` * to `<Apache-Solr data dir>/typo3lib` Add following to `/etc/default/solr.in.sh` file ``` SOLR_OPTS="$SOLR_OPTS -Dsolr.config.lib.enabled=true" ``` Or do that in other ways to set the `solr.config.lib.enabled=true` to sys-props of Apache Solr Server.
1 parent ad25480 commit 7a62f65

File tree

9 files changed

+207
-12
lines changed

9 files changed

+207
-12
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ If applicable, add screenshots to help explain your problem.
2727
- TYPO3 Version: [e.g. 13.4.0]
2828
- Browser: [e.g. chrome, safari]
2929
- EXT:solr Version: [e.g. 13.0.0]
30-
- Used Apache Solr Version: [e.g. 9.7.0]
30+
- Used Apache Solr Version: [e.g. 9.8.0]
3131
- PHP Version: [e.g. 8.2.0]
3232
- MySQL Version: [e.g. 8.0.0]
3333

‎Docker/SolrServer/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM solr:9.7.0
1+
FROM solr:9.8.0
22
LABEL org.opencontainers.image.authors="dkd Internet Service GmbH [email protected]"
33
ENV TERM=linux
44

‎Docker/SolrServer/docker-entrypoint-initdb.d/as-sudo/fix-CVE-2025-24814.sh

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/usr/bin/env bash
2+
3+
PATH_SOLRCONFIG="/var/solr/data/configsets/ext_solr_13_0_0/conf"
4+
PATH_AND_FILENAME_SOLRCONFIG="${PATH_SOLRCONFIG}/solrconfig.xml"
5+
6+
PATH_SOLRXML="/var/solr/data/"
7+
PATH_AND_FILENAME_SOLRXML="${PATH_SOLRXML}/solr.xml"
8+
9+
if grep -q "<lib " "${PATH_AND_FILENAME_SOLRCONFIG}"; then
10+
echo "The Apache Solr instance is affected on CVE-2025-24814"
11+
echo " removing usages of <lib> tags in EXT:solr schemas and moving typo3lib from configset to solr.xml"
12+
13+
cp "${PATH_AND_FILENAME_SOLRCONFIG}" ${PATH_SOLRCONFIG}/solrconfig.xml.Backup-CVE-2025-24814
14+
sed -i ':a;N;N;s/.*\<lib .*//g' ${PATH_AND_FILENAME_SOLRCONFIG}
15+
16+
mv "${PATH_SOLRCONFIG}"/../typo3lib /var/solr/data/.
17+
18+
cp "${PATH_AND_FILENAME_SOLRXML}" ${PATH_SOLRXML}/solr.xml.Backup-CVE-2025-24814
19+
# shellcheck disable=SC2016,SC1004
20+
sed -i 's/<str name="modules">scripting<\/str>/<str name="modules">scripting,analytics,analysis-extras,langid,clustering,extraction,${solr.modules:}<\/str>\
21+
<str name="allowPaths">${solr.allowPaths:}<\/str>\
22+
<str name="allowUrls">${solr.allowUrls:}<\/str>\
23+
\
24+
<!-- TYPO3 Plugins -->\
25+
<str name="sharedLib">\/var\/solr\/data\/typo3lib\/<\/str>/g' ${PATH_AND_FILENAME_SOLRXML}
26+
fi
27+
28+

‎Documentation/Releases/solr-release-12-0.rst

+87
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,93 @@ Releases 12.0
66

77
.. include:: HintAboutOutdatedChangelog.rst.txt
88

9+
Release 12.0.6
10+
==============
11+
12+
This is a security release for TYPO3 12.4 LTS, containing:
13+
14+
!!![SECURITY] Update to Apache solr 9.8.0 : CVE-2025-24814
15+
----------------------------------------------------------
16+
17+
Updates EXT:solr to Apache Solr 9.8.0.
18+
19+
Apache Solr 9.8.0 disables the possibility to load the `jar` files with `lib` directive by default,
20+
which was used to load jar files within the EXT:solr configsets. Apache Solr 10.0.0 will drop that functionality.
21+
All Apache Solr libs, modules or plugins must be configured within the main server configuration files.
22+
See: https://issues.apache.org/jira/browse/SOLR-16781
23+
24+
Impact:
25+
~~~~~~~~~
26+
27+
Docker
28+
""""""
29+
30+
By using our official Docker image from https://hub.docker.com/r/typo3solr/ext-solr,
31+
you want to pull the image v. 12.0.6+ and restart the container with that image, which will run a migrationsscript
32+
automatically to secure the configuration in used volume automatically.
33+
No other steps are required.
34+
35+
Alternatively you can wipe the volume and start the container with v. 12.0.6+ image, but that method will wipe the index as well.
36+
37+
See the script `EXT:solr/Docker/SolrServer/docker-entrypoint-initdb.d/as-sudo/fix-CVE-2025-24814.sh`
38+
39+
40+
Other server setups
41+
"""""""""""""""""""
42+
43+
You have 2 possibilities to fix that issue in your Apache Solr Server:
44+
45+
46+
(PREFERRED) Migrate the EXT:solr's Apache Solr configuration
47+
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
48+
49+
50+
Refer to https://github.com/TYPO3-Solr/ext-solr/pull/4290/files .
51+
52+
Following 3 files are relevant:
53+
54+
* Changes in `Resources/Private/Solr/configsets/ext_solr_12_0_0/conf/solrconfig.xml`
55+
* Changes in `Resources/Private/Solr/solr.xml`
56+
* Movement from `<Apache-Solr data dir>/configsets/ext_solr_12_0_0/typo3lib/solr-typo3-plugin-6.0.0.jar`
57+
58+
* to `<Apache-Solr data dir>/typo3lib/solr-typo3-plugin-6.0.0.jar`
59+
60+
Steps:
61+
62+
#. Remove all occurrences of `<lib dir=".*` from `Resources/Private/Solr/configsets/ext_solr_12_0_0/conf/solrconfig.xml` file.
63+
#. Replace in `Resources/Private/Solr/solr.xml` file
64+
the snipped
65+
66+
.. code-block:: xml
67+
<str name="modules">scripting</str>
68+
69+
by
70+
71+
.. code-block:: xml
72+
<str name="modules">scripting,analytics,analysis-extras,langid,clustering,extraction,${solr.modules:}</str>
73+
<str name="allowPaths">${solr.allowPaths:}</str>
74+
<str name="allowUrls">${solr.allowUrls:}</str>
75+
76+
<!-- TYPO3 Plugins -->
77+
<str name="sharedLib">/var/solr/data/typo3lib/</str>
78+
#. Move the directory from `<Apache-Solr data dir>/configsets/ext_solr_12_0_0/typo3lib`
79+
80+
* to `<Apache-Solr data dir>/typo3lib`
81+
82+
83+
(NOT-RECOMMENDED) Re-enable <lib> directives on Apache Solr >=9.8.0 <10.0.0
84+
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
85+
86+
87+
Add following to `/etc/default/solr.in.sh` file
88+
89+
.. code-block:: shell
90+
SOLR_OPTS="$SOLR_OPTS -Dsolr.config.lib.enabled=true"
91+
92+
Or do that in other ways to set the `solr.config.lib.enabled=true` to sys-props of Apache Solr Server.
93+
94+
95+
996
Release 12.0.5
1097
==============
1198

‎Documentation/Releases/solr-release-13-0.rst

+83
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,89 @@
44
Releases 13.0
55
=============
66

7+
Release 13.0.1
8+
==============
9+
10+
!!![SECURITY] Update to Apache solr 9.8.0 : CVE-2025-24814
11+
----------------------------------------------------------
12+
13+
Updates EXT:solr to Apache Solr 9.8.0.
14+
15+
Apache Solr 9.8.0 disables the possibility to load the `jar` files with `lib` directive by default,
16+
which was used to load jar files within the EXT:solr configsets. Apache Solr 10.0.0 will drop that functionality.
17+
All Apache Solr libs, modules or plugins must be configured within the main server configuration files.
18+
See: https://issues.apache.org/jira/browse/SOLR-16781
19+
20+
Impact:
21+
~~~~~~~~~
22+
23+
Docker
24+
""""""
25+
26+
By using our official Docker image from https://hub.docker.com/r/typo3solr/ext-solr,
27+
you want to pull the image v. 13.0.1+ and restart the container with that image, which will run a migrationsscript
28+
automatically to secure the configuration in used volume automatically.
29+
No other steps are required.
30+
31+
Alternatively you can wipe the volume and start the container with v. 13.0.1+ image, but that method will wipe the index as well.
32+
33+
See the script `EXT:solr/Docker/SolrServer/docker-entrypoint-initdb.d/as-sudo/fix-CVE-2025-24814.sh`
34+
35+
36+
Other server setups
37+
"""""""""""""""""""
38+
39+
You have 2 possibilities to fix that issue in your Apache Solr Server:
40+
41+
42+
(PREFERRED) Migrate the EXT:solr's Apache Solr configuration
43+
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
44+
45+
46+
Refer to https://github.com/TYPO3-Solr/ext-solr/pull/4290/files .
47+
48+
Following 3 files are relevant:
49+
50+
* Changes in `Resources/Private/Solr/configsets/ext_solr_13_0_0/conf/solrconfig.xml`
51+
* Changes in `Resources/Private/Solr/solr.xml`
52+
* Movement from `<Apache-Solr data dir>/configsets/ext_solr_13_0_0/typo3lib/solr-typo3-plugin-6.0.0.jar`
53+
54+
* to `<Apache-Solr data dir>/typo3lib/solr-typo3-plugin-6.0.0.jar`
55+
56+
Steps:
57+
58+
#. Remove all occurrences of `<lib dir=".*` from `Resources/Private/Solr/configsets/ext_solr_13_0_0/conf/solrconfig.xml` file.
59+
#. Replace in `Resources/Private/Solr/solr.xml` file
60+
the snipped
61+
62+
.. code-block:: xml
63+
<str name="modules">scripting</str>
64+
65+
by
66+
67+
.. code-block:: xml
68+
<str name="modules">scripting,analytics,analysis-extras,langid,clustering,extraction,${solr.modules:}</str>
69+
<str name="allowPaths">${solr.allowPaths:}</str>
70+
<str name="allowUrls">${solr.allowUrls:}</str>
71+
72+
<!-- TYPO3 Plugins -->
73+
<str name="sharedLib">/var/solr/data/typo3lib/</str>
74+
#. Move the directory from `<Apache-Solr data dir>/configsets/ext_solr_13_0_0/typo3lib`
75+
76+
* to `<Apache-Solr data dir>/typo3lib`
77+
78+
79+
(NOT-RECOMMENDED) Re-enable <lib> directives on Apache Solr >=9.8.0 <10.0.0
80+
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
81+
82+
83+
Add following to `/etc/default/solr.in.sh` file
84+
85+
.. code-block:: shell
86+
SOLR_OPTS="$SOLR_OPTS -Dsolr.config.lib.enabled=true"
87+
88+
Or do that in other ways to set the `solr.config.lib.enabled=true` to sys-props of Apache Solr Server.
89+
790

891
Release 13.0.0
992
==============

‎Resources/Private/Solr/configsets/ext_solr_13_0_0/conf/solrconfig.xml

-9
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,6 @@
44

55
<abortOnConfigurationError>${solr.abortOnConfigurationError:true}</abortOnConfigurationError>
66

7-
<lib dir="${solr.install.dir:../../../..}/modules/extraction/lib/" regex=".*\.jar" />
8-
<lib dir="${solr.install.dir:../../../..}/modules/clustering/lib/" regex=".*\.jar" />
9-
<lib dir="${solr.install.dir:../../../..}/modules/langid/lib/" regex=".*\.jar" />
10-
<lib dir="${solr.install.dir:../../../..}/modules/analytics/lib/" regex=".*\.jar" />
11-
<lib dir="${solr.install.dir:../../../..}/modules/analysis-extras/lib/" regex=".*\.jar" />
12-
13-
<!-- TYPO3 Plugins -->
14-
<lib dir="typo3lib" regex=".*\.jar" />
15-
167
<directoryFactory name="DirectoryFactory"
178
class="solr.NRTCachingDirectoryFactory"/>
189

‎Resources/Private/Solr/solr.xml

+6-1
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,10 @@
1313
<int name="connTimeout">${connTimeout:0}</int>
1414
</shardHandlerFactory>
1515

16-
<str name="modules">scripting</str>
16+
<str name="modules">scripting,analytics,analysis-extras,langid,clustering,extraction,${solr.modules:}</str>
17+
<str name="allowPaths">${solr.allowPaths:}</str>
18+
<str name="allowUrls">${solr.allowUrls:}</str>
19+
20+
<!-- TYPO3 Plugins -->
21+
<str name="sharedLib">/var/solr/data/typo3lib/</str>
1722
</solr>

‎Resources/Private/Solr/configsets/ext_solr_13_0_0/typo3lib/solr-typo3-plugin-6.0.0.jar renamed to ‎Resources/Private/Solr/typo3lib/solr-typo3-plugin-6.0.0.jar

File renamed without changes.

‎composer.json

+1
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,7 @@
151151
"ext-solrdebugtools": "^13.0",
152152
"ext-solrmlt": "^13.0",
153153
"Apache-Solr": [
154+
"9.8.0",
154155
"9.7.0"
155156
],
156157
"configset": "ext_solr_13_0_0"

0 commit comments

Comments
 (0)