[Bug] Apache Solr version has a vulnerability due to HTTP/2 protocol allowing a denial of service CVE-2023-44487
- Dominant language
- Java
- Stars
- 15.3k
- Forks
- 3.8k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 160
Description
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Version
For pulsar version: `3.1.2` on branch: `branch-3.1` facing moderate vulnerability [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/cve-2023-44487), related to packages:
- org.apache.solr:solr-solrj
Below is the versions available in pulsar -
- 8.11.1
Maven Dependency
- pulsar - org.apache.pulsar 3.1.2
### Minimal reproduce step
Run Pulsar CI workflow on pulsar branch - `branch-3.1`
### What did you expect to see?
Expected to pass the `OWASP dependency check` under `Pulsar CI` workflow.
### What did you see instead?
Vulnerability
```
Error: Failed to execute goal org.owasp:dependency-check-maven:8.2.1:aggregate (default) on project pulsar:
Error:
Error: One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
Error:
Error: solr-solrj-8.11.1.jar: CVE-2023-44487(7.5)
```
### Anything else?
_No response_
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
Contributor guide
Research direction
Start with the solr.version declaration identifying solr-solrj 8.11.1 and check the dependency version needed to address CVE-2023-44487. Run the Pulsar CI workflow on branch-3.1 and verify that the OWASP dependency check no longer reports this vulnerability.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, ci-cd, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100