-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper error handling in Solr connection failures. The key changes in the patch occur in ckan/lib/search/query.py, where connection-related exceptions were previously wrapped in a SearchError containing the raw Solr error message (including the URL). The vulnerable code path executed 'raise SearchError(...)' with the original Solr exception message, which could include credentials from the Solr URL. The patch introduces a new SolrConnectionError to sanitize these messages. The Query.search method (or its helper functions like _check_query_parser) is the logical entry point for Solr query execution and error propagation, making it the root cause of the leak.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ckan | pip | >= 2.0.0, < 2.10.5 | 2.10.5 |
Ongoing coverage of React2Shell