GHSA-qw3f-w4pf-jh5f

Suggest an improvement
Source
https://github.com/advisories/GHSA-qw3f-w4pf-jh5f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-qw3f-w4pf-jh5f/GHSA-qw3f-w4pf-jh5f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qw3f-w4pf-jh5f
Aliases
Published
2022-06-01T00:00:36Z
Modified
2024-02-16T08:18:12.752176Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Regular expression denial of service in apache tika
Details

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.

Database specific
{
    "nvd_published_at": "2022-05-31T14:15:00Z",
    "cwe_ids": [
        "CWE-1333"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-03T22:18:15Z"
}
References

Affected packages

Maven / org.apache.tika:tika-core

Package

Name
org.apache.tika:tika-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tika/tika-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.17
Fixed
1.28.3

Affected versions

1.*

1.17
1.18
1.19
1.19.1
1.20
1.21
1.22
1.23
1.24
1.24.1
1.25
1.26
1.27
1.28
1.28.1
1.28.2