Cloudera Technical Service Bulletin 2017-236 (TSB): Sample solrconfig.xml file for enabling Solr/Sentry Authorization is missing critical attribute

Title: Sample solrconfig.xml file for enabling Solr/Sentry Authorization is missing critical attribute 

The solrconfig.xml.secure sample configuration which was provided with CDH, if used to create solrconfig.xml, does not enforce Sentry authorization on the request URI /update/json/docs because it is missing a necessary attribute.

Products affected: Solr (if Sentry enabled)

Releases affected:
CDH 5.8 and lower
CDH 5.9.2 and lower
CDH 5.10.1 and lower
CDH 5.11.1 and lower

Users affected: Those who are using Sentry authorization with Cloudera Search and who have used the provided sample configuration and have not specified the below attributes in their solrconfig.xml file.

Date/time of detection: May 18, 2017

Detected by: István Farkas, Hrishikesh Gadre

Severity (Low/Medium/High): High

Impact: Unauthorized users using the request URI /update/json/docs may insert, update, or delete documents.

CVE: CVE-2017-9325

Immediate action required: 

Every solrconfig.xml of a collection protected by Sentry should be updated in Zookeeper.
Line of:

<updateRequestProcessorChain name="updateIndexAuthorization">
Must be replaced with 

<updateRequestProcessorChain name="updateIndexAuthorization" default="true">

After updating the configuration in Zookeeper, the collections must be reloaded.

Addressed in release/refresh/patch:
The following releases will contain the fixed sample configuration file.
CDH 5.9.3 and higher
CDH 5.10.2 and higher
CDH 5.11.2 and higher
CDH 5.12.0 and higher

Upgrading will only correct the sample configuration file. The fix mentioned above will still need to be applied on the affected cluster.

For the latest update on this issue see the corresponding Knowledge article: 

TSB 2017-236: Sample solrconfig.xml file for enabling Solr/Sentry Authorization is missing critical attribute

All rights belong to: Cloudera, Inc. 395 Page Mill Rd, 3rd Floor · Palo Alto, CA 94306 USA