Apache Tika contains incomplete fix for regex DoS

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2022-33879 · ADVISORY
• lists.apache.org/thread/wfno8mf5nlcvbs78z93q9thgrm30wwfh · WEB
• security.netapp.com/advisory/ntap-20220812-0004 · WEB
• openwall.com/lists/oss-security/2022/06/27/5 · WEB
• security.netapp.com/advisory/ntap-20220812-0004 · Third Party Advisory

Lỗ hổng khác của org.apache.tika:tika

• CVE-2022-25169TRUNG BÌNH 5.5The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
• CVE-2021-28657TRUNG BÌNH 5.5A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should…
• CVE-2020-9489TRUNG BÌNH 5.5A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of mem…
• CVE-2020-1951TRUNG BÌNH 5.5A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
• CVE-2020-1950TRUNG BÌNH 5.5A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.