In short
- CVE-2022-25169 is a MEDIUM (CVSS 5.5) vulnerability affecting org.apache.tika:tika, tika (apache), primavera unifier (oracle).
- Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.5% of all vulnerabilities.
- Fix: update to 2.4.0, 1.28.2 or later.
| Package | Affected versions | Patched versions |
|---|
| org.apache.tika:tika Maven | ≥ 2.0.0, < 2.4.0< 1.28.2
| 2.4.01.28.2
|
| tika | ≥ 2.0.0, < 2.4.0< 1.28.2
| 2.4.01.28.2
|
| primavera unifier | = 18.8= 19.12= 20.12= 21.12≥ 17.7, ≤ 17.12
| No fix yet |
Description
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
NVD description
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
More vulnerabilities in org.apache.tika:tika
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free