1

In our environment, we are using Sitecore 8.2 Update-2, and our SOLR version is 6.6.2 in cloud mode (distributed mode). During one of our security vulnerability scans our security team has pointed out few critical security issues on SOLR 6.6.2 and we also discovered that this version is at EOL (end of life). We know that the only thing left is to upgrade to the latest version of Sitecore and SOLR, but that will take a significant amount of time, so our management suggests disabling the SOLR and run Sitecore without it. As far I know Sitecore requires the SOLR to work properly. Is there any case study or link that suggest how to do it without breaking your website

Improve this question
2
  • 1
    Sitecore CM needs Solr in many places. Your website is also likely to use search. I suggest you open a support ticket with Sitecore to get an official recommendation.
    – Michael West
    Mar 23, 2021 at 5:35
  • We have opened a ticket with Sitecore support and they mentioned in their response that we cannot disable the SOLR as Sitecore needs it for various purposes. So, I believe we need to formulate a schedule for an upgrade.
    – Deepak Nangia
    Mar 24, 2021 at 5:16

1 Answer 1

Reset to default
3

1 - Solr versions 5.0–5.5.5, 6.0–6.6.5 are affected by security vulnerability CVE-2019-0192 (SOLR-13301).

As Sitecore Solr compatibility matrix KB article says you have couple of options how to solve this issue:

  • Upgrade to Sitecore XP 9.1 and use Apache Solr 7.2.1.
  • Disable the Config API by running Solr with the system property disable.configEdit=true.
  • Upgrade to Solr 6.6.6
  • If upgrading or disabling the Config API are not viable options, apply SOLR-13301.patch and re-compile Solr.
  • Ensure your network settings are configured so that only trusted traffic is allowed to ingress/egress your hosts running Solr.

In the matrix for XP 8.2, Solr 6.6.6 is also marked as compatible although with note "not officially tested, but expected to work".

enter image description here

I would definitely go with this option in your case. Solr is really strict about version numbering and there are definitely (a.k.a. shouldn't be :-)) no breaking changes between 6.6.2 and 6.6.6.

2 - Upgrading Solr to 6.6.6 shouldn't be that time consuming. You basically need to setup up new environment for Solr 6.6.6, create / populate Sitecore cores and do rebuild of indexes to this new environment from Sitecore. That's it.

Improve this answer
1
  • Thanks @Peter Prochazka for your suggestion, but our security team wants to upgrade the SOLR to 8.4, and for that, we need to upgrade our Sitecore instance as well.
    – Deepak Nangia
    Mar 24, 2021 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.