Researchers find hidden vulnerabilities in hundreds of Docker containers

CVE-2019-17558 is a remote code execution flaw in the VelocityResponseWriter plug-in of Apache Solr 5.0.0 through 8.3.1, caused by improper handling of Velocity template content (CWE-74). An attacker can supply a renderable, potentially malicious Velocity template either from the configset's velocity/ directory or, when a response writer has been configured with params.resource.loader.enabled set to true (which requires Config API access), directly via request parameters; parameter-provided templates are disabled by default and the vulnerable path was removed entirely in Solr 8.4. Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the Solr process, risking compromise of the host and indexed data. Any Solr deployment running 5.0.0–8.3.1 is affected, and Oracle Primavera Unifier is also impacted because it bundles the affected Solr component. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, with EPSS estimating a 98.6% probability of exploitation in the next 30 days.

Do: Upgrade to Apache Solr 8.4 or later per vendor instructions (CISA's required action). If upgrading is deferred, avoid enabling params.resource.loader.enabled on custom response writers, restrict access to the Solr Config API, limit Solr's network exposure, and review access logs for requests passing velocity template parameters. Oracle Primavera Unifier customers should apply the applicable Oracle Critical Patch Update.

Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile).

Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use.

Apache HTTP Server contains a path traversal flaw (CWE-22) that can lead to remote code execution; CVE-2021-42013 resolves an incomplete patch previously issued for CVE-2021-41773. The flaw is triggered when files outside directories mapped by Alias-like directives are not protected by the default 'require all denied' configuration, or when CGI scripts are enabled, allowing an attacker to traverse outside the intended directory roots. An attacker can read files outside the configured paths, and where CGI script execution is enabled, achieve remote code execution on the server. The affected product per CISA is Apache HTTP Server; the source data does not specify exact version ranges, so defenders should consult the vendor advisory for fixed releases. Exploitation is confirmed in the wild: the vulnerability was added to CISA KEV on 2021-11-03 with known ransomware use, EPSS estimates a 100% probability of exploitation within 30 days, and no public PoC is listed.

Do: Apply the Apache HTTP Server update per vendor instructions immediately, since this is a CISA KEV item with known ransomware use and near-certain near-term exploitation. Until patched, ensure directories targeted by Alias-like directives are covered by 'require all denied' defaults and disable CGI script execution where it is not required. Review access logs for path traversal probes and confirm no replaced version retains the incomplete earlier patch.