Fluid Attacks Database

Description

Apache Tika contains incomplete fix for regex DoS The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.apache.tika:tika-core	>=0 <1.28.4 \|\| >=2.0.0 <2.4.1	1.28.4, 2.4.1
maven	org.apache.tika:tika-server	>=0 <1.28.4 \|\| >=2.0.0 <2.4.1	1.28.4, 2.4.1
maven	org.apache.tika:tika-parsers	>=0 <1.28.4 \|\| >=2.0.0 <2.4.1	1.28.4, 2.4.1
maven	org.apache.tika:tika-parser-image-module	>=0 <1.28.4 \|\| >=2.0.0 <2.4.1	1.28.4, 2.4.1
maven	org.apache.tika:tika	>=0 <1.28.4 \|\| >=2.0.0 <2.4.1	1.28.4, 2.4.1
debian 11	tika	=1.22-2 \|\| =1.22-2+deb11u1	-
maven	org.apache.tika:tika-app	>=0 <1.28.4 \|\| >=2.0.0 <2.4.1	1.28.4, 2.4.1
maven	org.apache.tika:tika-bundle	>=0 <1.28.4 \|\| >=2.0.0 <2.4.1	1.28.4, 2.4.1

Aliases

1. CVE-2022-338792. NVD-2022-338793. OSV-2022-338794. OSV-DEBIAN-2022-338795. GCVE-2022-338796. SECURITY-TRACKER-CVE-2022-33879

References

1. https://lists.apache.org/thread/wfno8mf5nlcvbs78z93q9thgrm30wwfh2. http://www.openwall.com/lists/oss-security/2022/06/27/53. https://security.netapp.com/advisory/ntap-20220812-0004

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.