Re: CVE-2021-31684: SOLR- net.minidev_json-smart (Out of Bounds Read)

2024-02-13 Thread Shawn Heisey
On 2/13/2024 10:06, Shahryar Shagoshtasbi wrote: Thank you for your prompt response. Our scans have detected these CVEs in 9.1 and higher (At least the one we have tested). I’d highly appreciate if you could link me to the appropriate changelog for these changes. Solr 8.11.3 was announced onl

Need suggestions on performance improvement in Solr based application

2024-02-13 Thread Fiz N
Hi SOLR Experts, I am facing one challenge regarding performance in *Java Spring Boot + Apache Solr Cloud *based application. Details are as follows: *Data present in Solr collection*: 41 million *Shards:* 8 *Replicas:* 2 *Solr Version:* 8.2.0 *Issue:* we are having export functionality base

Re: CVE-2021-31684: SOLR- net.minidev_json-smart (Out of Bounds Read)

2024-02-13 Thread Jan Høydahl
Not vulnerable since 9.3. Newest is 9.5. Changelog on Solr website and in GitHub. Always check newest version before filing a bug/mail. 9.x versions prior to 9.5 will not receive bug fixes. Jan Høydahl > 13. feb. 2024 kl. 18:07 skrev Shahryar Shagoshtasbi > : > > Hi there, > > Thank you for

firstSearcher listener replaying queries 3 times

2024-02-13 Thread rajani m
Hi Solr Users, The first searcher listener replays the list of queries under the listener list 3 times, wondering what could be the reason for it? In the below example, when the collection is reloaded, the "q" is replayed 3 times, I expected it to be once. Is it a bug or the first searcher tri

RE: Re: CVE-2021-31684: SOLR- net.minidev_json-smart (Out of Bounds Read)

2024-02-13 Thread Shahryar Shagoshtasbi
Hi there, Thank you for your prompt response. Our scans have detected these CVEs in 9.1 and higher (At least the one we have tested). I’d highly appreciate if you could link me to the appropriate changelog for these changes. Thanks. On 2024/02/13 16:55:24 Jan Høydahl wrote: > Hi Shahryar, >

Re: CVE-2021-31684: SOLR- net.minidev_json-smart (Out of Bounds Read)

2024-02-13 Thread Jan Høydahl
Hi Shahryar, You do not specify what versions of Solr you believe to be vulnerable to those two CVEs. A quick check finds that they are both already plugged both in all actively supported versions of Solr (i.e. 9.x and 8.11.x). In the future you can check this yourself by looking at Solr's chan

CVE-2021-31684: SOLR- net.minidev_json-smart (Out of Bounds Read)

2024-02-13 Thread Shahryar Shagoshtasbi
CVE-2021-31684: Description A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request. Severity: High The issue has been fixed in versions 2.4.4, 1.3.3 Credit: Shahry

CVE-2023-36478: SOLR-Eclipse Jetty Overflow

2024-02-13 Thread Shahryar Shagoshtasbi
CVE-2023-36478: Description: Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit.

Query num docs having vector fields

2024-02-13 Thread rajani m
Hi Solr Users, Is there a way to query the total number of documents in the index that have vector fields? I tried the luke endpoint which returns definition, but it does not return "docs" attribute. The vector:* does not work. Any alternatives to this? Solr 9.1.1 version. Thank you, Rajani

Re: Questions regarding Query injection

2024-02-13 Thread Tim Funk
If using java - there is a utility class/method for example import org.apache.solr.client.solrj.util.ClientUtils; solrQuery.addFilterQuery("field_name:" + ClientUtils.escapeQueryChars(field_value)); -Tim On Tue, Feb 13, 2024 at 1:28 AM Ohms, Jannis wrote: > Hi all, > > I want to use user suppl

Re: Performance issue with solr 7.5.0 and docValues

2024-02-13 Thread Rahul Goswami
Can you pass debug=true with your query to find out which phase (query or faceting) takes more time? This is to eliminate chasing the wrong symptom to optimize for. -Rahul On Tue, Feb 13, 2024 at 3:48 AM Mikhail Khludnev wrote: > Hello, Arun. > Why don't you warm a new searcher with a query li

Re: tlogs not getting purged in TLOG replica set up

2024-02-13 Thread 6harat
Hi Ramesh, >I heard that they will be deleted on the replica node only when a leader change occurs While I am no solr expert, this understanding is incorrect AFAIK. The replication handler internally sets up a listener for switching transaction logs on the non-leader TLOG replicas. Unless you have

Re: Group + collapse query doubt

2024-02-13 Thread Angad Sharma
Hi. Still need help regarding this On Mon, 19 Jun, 2023, 5:04 pm Angad Sharma, wrote: > Hi, > > Can anyone help me with this? > > On Mon, 12 Jun, 2023, 8:07 pm Angad Sharma, > wrote: > >> I use solr 7.1 in production right now. We use group >> query to group on "query _type" field, and collaps

Re: Performance issue with solr 7.5.0 and docValues

2024-02-13 Thread Mikhail Khludnev
Hello, Arun. Why don't you warm a new searcher with a query listener? On Tue, Feb 13, 2024 at 3:18 AM Arun Sudhir wrote: > Hello, > We use solr for our search needs and we have documents indexed on a core in > multiple machines. Over time, the index on some machines has grown from 30 > GB to 60