epugh opened a new pull request, #229: URL: https://github.com/apache/solr-site/pull/229
The `not_affected` statement for **CVE-2025-48734** (commons-beanutils `declaredClass` class-loader access) used an open range `3.6.0-10.0.0`. The upgrade to commons-beanutils 1.11.0 (SOLR-17825 / SOLR-17918) has since landed on every active development branch, so the affected range should be capped. Verified across images, shaded uber-jar contents, and per-module lockfiles: | Solr | shaded in `hadoop-client-runtime` | standalone (`cross-dc-manager`) | verdict | |---|---|---|---| | 9.0.0–9.7.0 | 1.9.4 | — | affected | | 9.8.0–9.10.1 | 1.9.4 | 1.9.4 | affected | | 10.0.0 (no hadoop) | — | 1.9.4 | affected | | **9.11 / branch_9x** | gone (Hadoop 3.4.3 dropped it) | **1.11.0** | **fixed** | | **10.1 / branch_10x, main** | — | **1.11.0** | **fixed** | Two things make 9.11 clean: the `cross-dc-manager` copy was upgraded to **1.11.0**, and Hadoop **3.4.3** (shipped in 9.11) removed the shaded commons-beanutils that 3.4.1 carried inside `hadoop-client-runtime` (3.4.1 shaded 161 beanutils classes; 3.4.3 has none). 10.1/main have no Hadoop and ship the 1.11.0 standalone copy. Change: `versions: "3.6.0-10.0.0"` → **`"3.6.0-9.10.1, 10.0.0"`**, plus a body note documenting the fix. The comma form matters because a plain `3.6.0-10.0.0` would wrongly sweep in the fixed 9.11 (it sorts below 10.0.0) once released. Disposition unchanged (`not_affected` / `code_not_reachable`). Site builds, statement emits the correct `commons-beanutils` purls, `vexctl merge` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
