Deserialization of Untrusted Data Vulnerability Affecting Apache Lucene Replicator

CVE-2024-45772

Summary

A deserialization of untrusted data vulnerability exists in the Apache Lucene Lucene's replicator module, impacting versions from 4.4.0 up to 9.12.0. The vulnerability is linked to the deprecated org.apache.lucene.replicator.http package, which poses risks when deployed in network-accessible implementations. User-defined clients utilizing HTTP libraries that access this API may trigger the deserialization issue. To mitigate this vulnerability on affected versions, Java serialization filters can be implemented (e.g., using -Djdk.serialFilter='!*' on the command line), ensuring functionality is not disrupted. Users are highly encouraged to upgrade to version 9.12.0 or later, which corrects this flaw.

References