medium5.5
CVE-2022-25169
Apache Tika vulnerable to uncontrolled memory consumption
Impact
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.tika:tika | < 1.28.2 | 1.28.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Tika | before 1.28.2 from 2.0.0 before 2.4.0 |
| Oracle | Primavera Unifier | from 17.7 through 17.12 Versions 18.8, 19.12, 20.12, 21.12 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/05/16/4
- https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk
- https://security.netapp.com/advisory/ntap-20220804-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/advisories/GHSA-7qcq-xp2f-56f6
- https://nvd.nist.gov/vuln/detail/CVE-2022-25169