Upgrade Solr to fix vulnerabilities - E-MapReduce - Alibaba Cloud Documentation Center

On February 8, 2024, Apache Solr officially disclosed specific security vulnerabilities. These vulnerabilities may affect Solr of different versions and cause a variety of security risks. This topic describes the impacts of the vulnerabilities and how to fix them.

Impacts

Affected E-MapReduce (EMR) versions:

EMR V5.X series
EMR V3.X series

Details of the vulnerabilities:

CVE-2023-50386: Attackers can construct malicious requests to call the Backup or Restore API to arbitrarily run code.
CVE-2023-50298: Attackers can construct malicious requests to use streaming expressions to cause leaks of ZooKeeper credentials.
CVE-2023-50292: Attackers can construct malicious requests to use related interfaces to run code.
CVE-2023-50291: Attackers can construct malicious requests to use the /admin/info/properties endpoint to cause leaks of sensitive information.
CVE-2024-45216: Attackers can construct malicious requests to use PKIAuthenticationPlugin to cause authentication bypass and call API operations.

Fixing procedure

Note

The fixing procedure is applicable only to the following clusters in which the Ranger service is deployed.

DataLake, DataServing, and custom clusters

Click to download the Solr software package with the vulnerabilities fixed.
Upload the Solr software package to the /opt/apps/RANGER/ directory of the master node of your cluster.
```
scp solr-8.11.4.tar.gz master-1-1:/opt/apps/RANGER/
```
Log on to the master-1-1 node of your cluster. For more information, see Log on to a cluster.
Run the following command to decompress the Solr software package:
```
cd /opt/apps/RANGER/
tar xvf solr-8.11.4.tar.gz
```

Run the following commands to create a link file:

sudo ln -s /mnt/disk1/ranger/ranger_audit_server solr-8.11.4/ranger_audit_server
sudo chown -R solr:solr solr-8.11.4
sudo rm -f solr-current
sudo ln -s /opt/apps/RANGER/solr-8.11.4/ solr-current

Restart Solr on the Status tab of the Ranger service page in the EMR console.

Hadoop cluster

Click to download the Solr software package with the vulnerabilities fixed.
Upload the Solr software package to the /opt/apps/ecm/service/solr/8.11.0/package/ directory of the master node of your cluster.
```
scp solr-8.11.4.tgz.gz emr-header-1:/opt/apps/ecm/service/solr/8.11.0/package/
```
Log on to the emr-header-1 node of your cluster. For more information, see Log on to a cluster.

Run the following command to decompress the Solr software package:

cd /opt/apps/ecm/service/solr/8.11.0/package/
tar xvf solr-8.11.4.tar.gz

Run the following command to copy the startup script:
```
cp -r solr-8.11.0/ranger_audit_server/ solr-8.11.4/
```
Run the following command to back up the Solr software package solr-8.11.0:
```
mv solr-8.11.0 solr-8.11.0-backup
```
Run the following commands to change the ownership and group of the storage directory of the package and rename solr-8.11.4 as solr-8.11.0:
```
sudo chown -R solr:solr solr-8.11.4
mv solr-8.11.4 solr-8.11.0
```
Restart Solr on the Status tab of the Ranger service page in the EMR console.