Skip to content

Commit e1c164f

Browse files
dkd-friedrichdkd-friedrich
committed
[RELEASE] 12.1.1
This is a security release for TYPO3 12 LTS, containing an update of Apache Solr. Apache Solr 9.10.1 fixes several security issues, please upgrade your Apache Solr instance! - CVE-2025-54988 - CVE-2026-22444 - CVE-2026-22022 Please read the release notes: * https://docs.typo3.org/p/apache-solr-for-typo3/solr/12.1/en-us/Releases/solr-release-12-1.html * https://github.com/TYPO3-Solr/ext-solr/releases/tag/12.1.1 --- How to Get Involved There are many ways to get involved with Apache Solr for TYPO3: * Submit bug reports and feature requests on GitHub * Ask or help or answer questions in our Slack channel * Provide patches through pull requests or review and comment on existing pull requests * Go to www.typo3-solr.com or call dkd to sponsor the ongoing development of Apache Solr for TYPO3 Support us by becoming an EB partner: https://shop.dkd.de/Produkte/Apache-Solr-fuer-TYPO3/ or call: +49 (0)69 - 2475218 0
1 parent f941898 commit e1c164f

File tree

6 files changed

+631
-167
lines changed

6 files changed

+631
-167
lines changed

‎Documentation/Appendix/VersionMatrix.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ List of EXT:solr versions and the matching versions of Apache Solr and TYPO3 tha
1515
========= ============= ================ ============= ================= ==================== ======================= ================================ =============== =================
1616
TYPO3 EXT:solr (↻) EXT:solrmlt (↻) EXT:tika (↻) EXT:solrfal ($) EXT:solrconsole ($) EXT:solrdebugtools ($) EXT:solrfluidgrouping ($↺) Apache Solr Configset
1717
========= ============= ================ ============= ================= ==================== ======================= ================================ =============== =================
18-
12.4 12.1 12.0 (Ø) 12.1 12.0 12.0 12.0 N/A (integrated in EXT:solr) 9.10.0¹ ext_solr_12_1_0
18+
12.4 12.1 12.0 (Ø) 12.1 12.0 12.0 12.0 N/A (integrated in EXT:solr) 9.10.1¹ ext_solr_12_1_0
1919
========= ============= ================ ============= ================= ==================== ======================= ================================ =============== =================
2020

2121
| $ - Funding contribution extensions. See: https://www.typo3-solr.com/solr-for-typo3/open-source-version/

‎Documentation/Releases/solr-release-11-2.rst‎

Lines changed: 206 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,173 @@ Releases 11.2
88
.. include:: HintAboutOutdatedChangelog.rst.txt
99

1010

11+
Apache Solr for TYPO3 11.2.7 ELTS
12+
=================================
13+
14+
This is a non-public a security release for TYPO3 10.4 ELTS.
15+
16+
!!! Upgrade to Apache Solr 9.10.1
17+
---------------------------------
18+
19+
Apache Solr 9.10.1 fixes several security issues, please upgrade your Apache Solr instance!
20+
21+
* CVE-2025-54988: Apache Solr extraction module vulnerable to XXE attacks via XFA content in PDFs
22+
* CVE-2026-22444: Apache Solr: Insufficient file-access checking in standalone core-creation requests
23+
* CVE-2026-22022: Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
24+
25+
26+
Apache Solr for TYPO3 11.2.6 ELTS
27+
=================================
28+
29+
This is a non-public maintenance release for TYPO3 10.4 ELTS, containing:
30+
31+
* [FEATURE] Add arm64 platforms to docker-images and push to registry.dkd.de by Rafael Kähm (9a56f004a)
32+
* [TASK] Allow Apache Solr 9.8.1 by Rafael Kähm (d6d6de2c7)
33+
* [TASK] Set proper retention-days on actions/upload-artifact by Rafael Kähm (96b119381)
34+
* Revert "[TASK] Integrate TYPO3 10.4 ELTS" by Rafael Kähm (20a596125)
35+
36+
Apache Solr for TYPO3 11.2.5 ELTS
37+
=================================
38+
39+
This is a non-public security release for TYPO3 10.4 ELTS, containing:
40+
41+
!!![SECURITY] Update to Apache Solr 9.8.0 : CVE-2025-24814
42+
----------------------------------------------------------
43+
44+
Updates EXT:solr to Apache Solr 9.8.0.
45+
46+
Apache Solr 9.8.0 disables the possibility to load the `jar` files with `lib` directive by default,
47+
which was used to load jar files within the EXT:solr configsets. Apache Solr 10.0.0 will drop that functionality.
48+
All Apache Solr libs, modules or plugins must be configured within the main server configuration files.
49+
See: https://issues.apache.org/jira/browse/SOLR-16781
50+
51+
Impact:
52+
~~~~~~~
53+
54+
Docker
55+
""""""
56+
57+
You can wipe the volume and start the container with v. 11.2.5+ image, but that method will wipe the index as well.
58+
59+
See the script `EXT:solr/Docker/SolrServer/docker-entrypoint-initdb.d-as-sudo/fix-CVE-2025-24814.sh`
60+
61+
62+
Other server setups
63+
"""""""""""""""""""
64+
65+
You have 2 possibilities to fix that issue in your Apache Solr Server:
66+
67+
68+
(PREFERRED) Migrate the EXT:solr's Apache Solr configuration
69+
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
70+
71+
72+
Refer to https://github.com/TYPO3-Solr/ext-solr/pull/4290/files .
73+
74+
Following 3 files are relevant:
75+
76+
* Changes in `<Apache-Solr data dir>/configsets/ext_solr_11_2_0_elts/conf/solrconfig.xml`
77+
* Changes in `<Apache-Solr data dir>/solr.xml`
78+
* Movement from `<Apache-Solr data dir>/configsets/ext_solr_11_2_0_elts/typo3lib/solr-typo3-plugin-6.0.0.jar`
79+
80+
* to `<Apache-Solr data dir>/typo3lib/solr-typo3-plugin-6.0.0.jar`
81+
82+
Steps:
83+
84+
#. Remove all occurrences of `<lib dir=".*` from `<Apache-Solr data dir>/configsets/ext_solr_11_2_0_elts/conf/solrconfig.xml` file.
85+
#. Replace in `<Apache-Solr data dir>/solr.xml` file
86+
the snipped
87+
88+
.. code-block:: xml
89+
90+
<str name="modules">scripting</str>
91+
92+
by
93+
94+
.. code-block:: xml
95+
96+
<str name="modules">scripting,analytics,analysis-extras,langid,clustering,extraction,${solr.modules:}</str>
97+
<str name="allowPaths">${solr.allowPaths:}</str>
98+
<str name="allowUrls">${solr.allowUrls:}</str>
99+
100+
<!-- TYPO3 Plugins -->
101+
<str name="sharedLib">typo3lib/</str>
102+
#. Move the directory from `<Apache-Solr data dir>/configsets/ext_solr_11_2_0_elts/typo3lib`
103+
104+
* to `<Apache-Solr data dir>/typo3lib`
105+
106+
107+
(NOT-RECOMMENDED) Re-enable <lib> directives on Apache Solr >=9.8.0 <10.0.0
108+
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
109+
110+
111+
Add following to `/etc/default/solr.in.sh` file
112+
113+
.. code-block:: shell
114+
115+
SOLR_OPTS="$SOLR_OPTS -Dsolr.config.lib.enabled=true"
116+
117+
Or do that in other ways to set the `solr.config.lib.enabled=true` to sys-props of Apache Solr Server.
118+
119+
!!![FIX] Docker execution order issue for as-sudo tweaks
120+
--------------------------------------------------------
121+
122+
This change renames the file
123+
124+
* from `/docker-entrypoint-initdb.d/as-sudo-tweaks.sh`
125+
* to `/docker-entrypoint-initdb.d/0_as-sudo-tweaks.sh`
126+
127+
and moves the folder
128+
129+
* from `/docker-entrypoint-initdb.d/as-sudo/`
130+
* to `/docker-entrypoint-initdb.d-as-sudo/`
131+
132+
to fix the execution order issue when setting the correct file permissions
133+
when starting the docker container, leading to a `Operation not permitted` errors.
134+
135+
More details see:
136+
137+
* https://github.com/TYPO3-Solr/ext-solr/issues/3837#issuecomment-2461668377.
138+
* https://github.com/TYPO3-Solr/ext-solr/pull/4219#issuecomment-2622600937
139+
140+
Impact:
141+
~~~~~~~
142+
143+
This change requires adjustments in your Docker setup, only if you modified:
144+
145+
* files in folder `/docker-entrypoint-initdb.d/as-sudo/`
146+
* file `/docker-entrypoint-initdb.d/as-sudo-tweaks.sh`.
147+
148+
Make sure to use:
149+
"""""""""""""""""
150+
151+
* `/docker-entrypoint-initdb.d/0_as-sudo-tweaks.sh` instead of
152+
153+
* `/docker-entrypoint-initdb.d/as-sudo-tweaks.sh`
154+
155+
* `/docker-entrypoint-initdb.d-as-sudo` instead of
156+
157+
* `/docker-entrypoint-initdb.d/as-sudo/`
158+
159+
Upgrade to Apache Solr 9.7.0
160+
----------------------------
161+
162+
This release requires Apache Solr v9.7.0+.
163+
164+
Along with the compatibility to Solr 9.7 the dependency to SOLR_ENABLE_STREAM_BODY is removed.
165+
166+
167+
Minor changes & bugfixes
168+
------------------------
169+
170+
* [TASK] Update GitHub actions by @dkd-friedrich in #42
171+
* [DOCS] Improve Solr core creation via API and other deployment parts by @dkd-kaehm & @dkd-friedrich in #42
172+
* [TASK] Use relative path to typo3lib in Apache Solr config by @dkd-kaehm & @dkd-friedrich in #42
173+
* [BUGFIX] Docker twaks as-sudo do not preserve the Docker image ENV by @dkd-kaehm & @dkd-friedrich in #42
174+
* [BUGFIX] Docker tests suite does not contain all logs by @dkd-kaehm & @dkd-friedrich in #42
175+
* [BUGFIX] docker image tests do not fail if core can not start by @dkd-kaehm & @dkd-friedrich in #42
176+
177+
11178
Release 11.2.4 ELTS
12179
===================
13180

@@ -172,15 +339,45 @@ awesome community. Here are the contributors to this release.
172339
Also a big thank you to our partners who have already concluded one of our new development participation packages such as Apache Solr EB for TYPO3 11 LTS (Feature), Apache Solr EB for TYPO3 10 LTS (Maintenance)
173340
or Apache Solr EB for TYPO3 9 ELTS (Extended):
174341

175-
* ACO Ahlmann SE & Co. KG
176-
* avenit AG
177-
* b13 GmbH
178-
* cyperfection GmbH
179-
* in2code GmbH
180-
* Leitgab Gernot
181-
* medien.de mde GmbH
182-
* TOUMORØ
183-
* WIND Internet
342+
* ACO Ahlmann SE & Co. KG
343+
* AmedickSommer Neue Medien GmbH
344+
* Causal Sarl
345+
* Cobytes
346+
* Columbus Interactive GmbH
347+
* Connetation Web Engineering GmbH
348+
* cyperfection GmbH
349+
* FONDA GmbH
350+
* Hochschule Niederrhein
351+
* i-fabrik GmbH
352+
* i-kiu motion, graphic, backend gmbh
353+
* in2code
354+
* Intersim AG
355+
* jweiland
356+
* Landeskriminalamtes Thüringen
357+
* Leitgab Gernot
358+
* medien.de mde GmbH
359+
* MOSAIQ GmbH Glenn Kusardi
360+
* NEW.EGO GmbH
361+
* novotegra
362+
* Pädagogische Hochschule Karlsruhe
363+
* ProPotsdam GmbH
364+
* proudnerds.com
365+
* Provitex GmbH
366+
* PSV NEO GmbH
367+
* Québec.ca gouv.qc.ca
368+
* Shopseam media group gmbh
369+
* Shopwegewerk GmbH
370+
* SOS Software Service GmbH
371+
* Studio 9 GmbH
372+
* techniconcept.ch
373+
* tirol.gv.at Land Tirol, p.A. DVT-Daten-Verarbeitung-Tirol GmbH
374+
* TOUMORØ
375+
* visuellverstehen GmbH
376+
* WACON Internet GmbH
377+
* WE DO communication GmbH GWA
378+
* we.byte GmbH
379+
* webschuppen GmbH
380+
* WIND Internet BV
184381

185382
How to Get Involved
186383
===================

0 commit comments

Comments
 (0)