Fluid Attacks Database

Description

Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.apache.tika:tika-parsers	>=1.8 <1.20	1.20
debian 11	tika	>=0 <1.20-1	1.20-1
maven	org.apache.tika:tika-core	>=1.8 <=1.19.1	1.20

Aliases

1. CVE-2018-171972. NVD-2018-171973. OSV-2018-171974. OSV-DEBIAN-2018-171975. GHSA-3448-vfvv-xp9g6. GCVE-2018-171977. SECURITY-TRACKER-CVE-2018-17197

References

1. https://lists.apache.org/thread.html/7c021a4ea2037e52e74628e17e8e0e2acab1f447160edc8be0eae6d3@%3Cdev.tika.apache.org%3E2. https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E3. https://www.oracle.com/security-alerts/cpuapr2020.html4. https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html5. http://www.securityfocus.com/bid/106293

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.