From 60e3fa97a901a1fef0df2c2449a5d2392b21196c Mon Sep 17 00:00:00 2001
From: Alex Clark <amsclark@gmail.com>
Date: Mon, 20 Jan 2025 03:04:02 -0600
Subject: [PATCH] Lucene Package Update to Address CVE-2024-43383 (#17942)

* Update Lucene Package to 4.8.0-beta00017

* Add Package Reference

---------

Co-authored-by: Sebastiaan Janssen <sebastiaan@umbraco.com>
---
 Directory.Packages.props                                 | 4 +++-
 src/Umbraco.Examine.Lucene/Umbraco.Examine.Lucene.csproj | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index d0ced18737..eb15199e0a 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -91,6 +91,8 @@
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
     <!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
     <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.7.1" />
+    <!-- Examine.Lucene bring in a vulnerable version of Lucene.Net.Replicator -->
+    <PackageVersion Include="Lucene.Net.Replicator" Version="4.8.0-beta00017" />
     <!-- Both OpenIddict.AspNetCore, Microsoft.EntityFrameworkCore.* bring in a vulnerable version of Microsoft.Extensions.Caching.Memory -->
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
     <!-- Both Azure.Identity, Microsoft.EntityFrameworkCore.SqlServer,NPoco.SqlServer, and more bring in a vulnerable version of System.Text.Json -->
@@ -98,4 +100,4 @@
     <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Microsoft.Data.SqlClient -->
     <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.2" />
   </ItemGroup>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/src/Umbraco.Examine.Lucene/Umbraco.Examine.Lucene.csproj b/src/Umbraco.Examine.Lucene/Umbraco.Examine.Lucene.csproj
index 7e28eb6971..dd9d5a4115 100644
--- a/src/Umbraco.Examine.Lucene/Umbraco.Examine.Lucene.csproj
+++ b/src/Umbraco.Examine.Lucene/Umbraco.Examine.Lucene.csproj
@@ -10,6 +10,8 @@
     <PackageReference Include="Examine" />
     <!-- Take top-level depedendency on System.Security.Cryptography.Xml, because Examine depends on a vulnerable version -->
     <PackageReference Include="System.Security.Cryptography.Xml" />
+    <!-- Take top-level depedendency on Lucene.Net.Replicator-->
+    <PackageReference Include="Lucene.Net.Replicator" />
   </ItemGroup>
 
   <ItemGroup>