<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class="">Hi,</div>
<div class="">thanks for your answer.</div>
<div class=""><br class="">
</div>
<div class="">I confirm, mitigate this issue is very very easy.</div>
<div class="">There are other issues with high severity for example CVE-2019-17558. </div>
<div class=""><br class="">
</div>
<div class="">Description: Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter</div>
<div class=""><br class="">
</div>
<div class="">I think for this issue there is only a solution, upgrade Solr to 8.4. It's Correct?</div>
<div class=""><br class="">
</div>
<div class="">So, with Dovecot is it possible to use Apache Solr 8.4? </div>
<div class="">High RAM usage is the only problem?</div>
<div class=""><br class="">
</div>
<div class="">Thanks, </div>
<div class=""><br class="">
</div>
<div class="">Br,</div>
<div class="">Domenico</div>
<div class="">
<div dir="auto" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div><br class="Apple-interchange-newline">
<br class="">
<table width="310" cellspacing="0" cellpadding="0" border="0" class="">
<tbody class="">
<tr class="">
<td valign="top" style="border-top-width: 1px; border-top-style: solid; border-top-color: rgb(255, 102, 27); padding: 10px 0px 0px;" class="">
<span style="color: rgb(255, 102, 27); font-family: Arial, sans-serif; font-size: 14px;" class=""><strong class="">Domenico Pastore</strong></span><br class="">
<span style="font-family: Arial, sans-serif; font-size: 13px;" class="">Senior Cloud Engineer<br class="">
</span></td>
</tr>
<tr class="">
<td valign="top" style="padding: 10px 0px 0px;" class=""><span style="font-family: Arial, sans-serif; font-size: 13px;" class=""><strong class="">T</strong> 06.98269600 <span style="color: rgb(255, 102, 27);" class="">|</span> <strong class="">M</strong> 347.1474270 <span style="color: rgb(255, 102, 27);" class="">|</span> <strong class="">F</strong> 06.98269680</span></td>
</tr>
<tr class="">
<td valign="top" style="padding: 10px 0px 0px;" class=""><span style="font-family: Arial, sans-serif; font-size: 13px;" class=""><strong class=""><a href="http://www.par-tec.it" target="_blank" style="color: rgb(149, 79, 114);" class="">Par-Tec</a></strong> <span style="color: rgb(255, 102, 27);" class="">|</span> <strong class="">beyond
the IT domain</strong><br class="">
Via Cristoforo Colombo 163, 00147 Roma</span></td>
</tr>
<tr class="">
<td valign="top" style="padding: 10px 0px 0px;" class=""><span style="color: rgb(153, 153, 153); font-family: Calibri, Arial, sans-serif; font-size: 10px;" class=""><strong class="">CONFIDENZIALE</strong>: Questo messaggio ed i suoi allegati sono di carattere
confidenziale. È vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore si prega di informare il mittente e cancellarlo immediatamente.</span></td>
</tr>
</tbody>
</table>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
</div>
<br class="Apple-interchange-newline" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="Apple-interchange-newline">
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">Il giorno 22 gen 2020, alle ore 15:26, <a href="mailto:deano-dovecot@areyes.com" class="">
deano-dovecot@areyes.com</a> ha scritto:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">On 2020-01-22 8:42 am, Domenico Pastore wrote:<br class="">
<blockquote type="cite" class="">Hello,<br class="">
I have Dovecot configured with Solr for the indexes.<br class="">
I have need your support for upgrade solr 7.7.2 to 8.4.1.<br class="">
Solr 7.7.2 has a security issue CVE-2019-12409.<br class="">
It's possible upgrade of Solr?<br class="">
Dovecot work correctly with Solr 8.x?<br class="">
The Solr documentation recommended after updating:<br class="">
"It is always strongly recommended that you fully reindex your<br class="">
documents after a major version upgrade."<br class="">
There are tips for Dovecot?<br class="">
</blockquote>
<br class="">
Easy mitigation - block or control all access on port 18983 via iptables ? Might be a bit of a blanket statement though ...<br class="">
<br class="">
Be aware than later version of Solr use a *lot* more ram. I tested last year with 8.3.0 and even with tuning was seeing a much higher higher RES memory usage.<br class="">
<br class="">
DC<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</body>
</html>