CVE-2024-45772

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.<br /> <br /> This issue affects Apache Lucene&amp;#39;s replicator module: from 4.4.0 before 9.12.0.<br /> The deprecated org.apache.lucene.replicator.http package is affected.<br /> The org.apache.lucene.replicator.nrt package is not affected.<br /> <br /> Users are recommended to upgrade to version 9.12.0, which fixes the issue.<br /> <br /> The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter=&amp;#39;!*&amp;#39; on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.