medium5.5
CVE-2018-1339
org.apache.tika:tika-parsers has an Infinite Loop vulnerability
Impact
Versions of the package `org.apache.tika:tika-parsers` before version 1.18 are vulnerable to Denial of Service (DoS) via a carefully crafted (or fuzzed) file that can trigger an infinite loop via the ChmParser.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.tika:tika-parsers | < 1.18 | 1.18 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Tika | before 1.18 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2018:2669
- https://lists.apache.org/thread.html/4d2cb5c819401bb075e2a1130e0d14f0404a136541a6f91da0225828%40%3Cdev.tika.apache.org%3E
- https://github.com/advisories/GHSA-p699-3wgc-7h72
- https://nvd.nist.gov/vuln/detail/CVE-2018-1339
- https://lists.apache.org/thread.html/4d2cb5c819401bb075e2a1130e0d14f0404a136541a6f91da0225828@%3Cdev.tika.apache.org%3E
- https://github.com/apache/tika/commit/1b6ca3685c196cfd89f5f95c19cc919ce10c5aff#diff-43f8cbe58aaab159ce88bd95fafc46dd