Apache Tika vulnerable to uncontrolled memory consumption

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-25169 · ADVISORY
• apache/tika · PACKAGE
• lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk · WEB
• security.netapp.com/advisory/ntap-20220804-0004 · WEB
• oracle.com/security-alerts/cpujul2022.html · WEB
• openwall.com/lists/oss-security/2022/05/16/4 · WEB
• security.netapp.com/advisory/ntap-20220804-0004 · Third Party Advisory

org.apache.tika:tika のその他の脆弱性

• CVE-2022-33879低 3.3The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found …
• CVE-2021-28657中 5.5A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should…
• CVE-2020-9489中 5.5A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of mem…
• CVE-2020-1951中 5.5A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
• CVE-2020-1950中 5.5A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.