[Bugs] [Bug 13330] New: [CVE 21] tika 1.17 CVEs found

Ср Май 3 17:21:16 MSK 2023

https://bugzilla.rosalinux.ru/show_bug.cgi?id=13330

          Platform: 2021.1
            Bug ID: 13330
           Summary: [CVE 21] tika 1.17  CVEs found
    Classification: ROSA-based products
           Product: ROSA Fresh
           Version: All
          Hardware: All
               URL: CVE-2018-11761, CVE-2018-11762, CVE-2018-11796,
                    CVE-2018-1335, CVE-2018-1338, CVE-2018-1339,
                    CVE-2018-17197, CVE-2018-8017, CVE-2019-10088,
                    CVE-2019-10094, CVE-2020-1950, CVE-2020-1951,
                    CVE-2022-25169, CVE-2022-30126, CVE-2022-30973,
                    CVE-2022-33879,
                OS: Linux
            Status: CONFIRMED
          Severity: normal
          Priority: Normal
         Component: System (kernel, glibc, systemd, bash, PAM...)
          Assignee: bugs на lists.rosalinux.ru
          Reporter: y.tumanov на rosalinux.ru
        QA Contact: bugs на lists.rosalinux.ru
                CC: s.matveev на rosalinux.ru, y.tumanov на rosalinux.ru
  Target Milestone: ---
             Flags: secteam_verified?

Please patch CVEs for package tika version 1.17

INFO (CVEs are): tika 1.17
 cves found
CVE-2018-11761
Desc: In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit
entity expansion. They were therefore vulnerable to an entity expansion
vulnerability which can lead to a denial of service attack.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-11761
Severity: HIGH
CVE-2018-11762
Desc: In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not
specify an extract directory on the commandline (--extract-dir=) and the input
file has an embedded file with an absolute path, such as "C:/evil.bat",
tika-app would overwrite that file.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-11762
Severity: MEDIUM
CVE-2018-11796
Desc: In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit
for XML parsing. However, Tika reuses SAXParsers and calls reset() after each
parse, which, for Xerces2 parsers, as per the documentation, removes the
user-specified SecurityManager and thus removes entity expansion limits after
the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still
vulnerable to entity expansions which can lead to a denial of service attack.
Users should upgrade to 1.19.1 or later.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-11796
Severity: HIGH
CVE-2018-1335
Desc: From Apache Tika versions 1.7 to 1.17, clients could send carefully
crafted headers to tika-server that could be used to inject commands into the
command line of the server running tika-server. This vulnerability only affects
those running tika-server on a server that is open to untrusted clients. The
mitigation is to upgrade to Tika 1.18.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1335
Severity: HIGH
CVE-2018-1338
Desc: A carefully crafted (or fuzzed) file can trigger an infinite loop in
Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1338
Severity: MEDIUM
CVE-2018-1339
Desc: A carefully crafted (or fuzzed) file can trigger an infinite loop in
Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1339
Severity: MEDIUM
CVE-2018-17197
Desc: A carefully crafted or corrupt sqlite file can cause an infinite loop in
Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-17197
Severity: MEDIUM
CVE-2018-8017
Desc: In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an
infinite loop in the IptcAnpaParser.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-8017
Severity: MEDIUM
CVE-2019-10088
Desc: A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's
RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or
later.
Link: https://nvd.nist.gov/vuln/detail/CVE-2019-10088
Severity: HIGH
CVE-2019-10094
Desc: A carefully crafted package/compressed file that, when
unzipped/uncompressed yields the same file (a quine), causes a
StackOverflowError in Apache Tika's RecursiveParserWrapper in versions
1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
Link: https://nvd.nist.gov/vuln/detail/CVE-2019-10094
Severity: HIGH
CVE-2020-1950
Desc: A carefully crafted or corrupt PSD file can cause excessive memory usage
in Apache Tika's PSDParser in versions 1.0-1.23.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1950
Severity: MEDIUM
CVE-2020-1951
Desc: A carefully crafted or corrupt PSD file can cause an infinite loop in
Apache Tika's PSDParser in versions 1.0-1.23.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1951
Severity: MEDIUM
CVE-2022-25169
Desc: The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may
allocate an unreasonable amount of memory on carefully crafted files.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-25169
Severity: MEDIUM
CVE-2022-30126
Desc: In Apache Tika, a regular expression in our StandardsText class, used by
the StandardsExtractingContentHandler could lead to a denial of service caused
by backtracking on a specially crafted file. This only affects users who are
running the StandardsExtractingContentHandler, which is a non-standard handler.
This is fixed in 1.28.2 and 2.4.0
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-30126
Severity: MEDIUM
CVE-2022-30973
Desc: We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the
1.28.2 release. In Apache Tika, a regular expression in the StandardsText
class, used by the StandardsExtractingContentHandler could lead to a denial of
service caused by backtracking on a specially crafted file. This only affects
users who are running the StandardsExtractingContentHandler, which is a
non-standard handler. This is fixed in 1.28.3.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-30973
Severity: MEDIUM
CVE-2022-33879
Desc: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the
StandardsExtractingContentHandler were insufficient, and we found a separate,
new regex DoS in a different regex in the StandardsExtractingContentHandler.
These are now fixed in 1.28.4 and 2.4.1.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-33879
Severity: LOW

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
----------- следущая часть -----------
Вложение в формате HTML было извлечено&hellip;
URL: <http://lists.rosalinux.ru/pipermail/bugs/attachments/20230503/028a1f6c/attachment.html>