Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA2OTktM3dnYy03aDcy
org.apache.tika:tika-parsers has an Infinite Loop vulnerability
Versions of the package org.apache.tika:tika-parsers before version 1.18 are vulnerable to Denial of Service (DoS) via a carefully crafted (or fuzzed) file that can trigger an infinite loop via the ChmParser.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA2OTktM3dnYy03aDcy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 5 years ago
Updated: about 1 year ago
CVSS Score: 5.5
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Identifiers: GHSA-p699-3wgc-7h72, CVE-2018-1339
References:
- https://nvd.nist.gov/vuln/detail/CVE-2018-1339
- https://access.redhat.com/errata/RHSA-2018:2669
- https://lists.apache.org/thread.html/4d2cb5c819401bb075e2a1130e0d14f0404a136541a6f91da0225828@%3Cdev.tika.apache.org%3E
- https://github.com/apache/tika/commit/1b6ca3685c196cfd89f5f95c19cc919ce10c5aff#diff-43f8cbe58aaab159ce88bd95fafc46dd
- https://github.com/advisories/GHSA-p699-3wgc-7h72
Blast Radius: 20.1
Affected Packages
maven:org.apache.tika:tika-parsers
Dependent packages: 310Dependent repositories: 4,443
Downloads:
Affected Version Ranges: < 1.18
Fixed in: 1.18
All affected versions:
All unaffected versions: 1.19.1, 1.24.1, 1.28.1, 1.28.2, 1.28.3, 1.28.4, 1.28.5, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.9.0, 2.9.1, 2.9.2