GitHub Advisoryadvisory · Maven

GHSA-p699-3wgc-7h72 org.apache.tika:tika-parsers has an Infinite Loop vulnerability

MEDIUM Published 2018-10-17 Modified 2023-02-28 Official page ↗
Aliases
CVE-2018-1339
Ecosystem
Maven
Packages
org.apache.tika:tika-parsers
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2020-06-16

Affected packages

• Maven org.apache.tika:tika-parsers: < 1.18 → fixed in 1.18

Description

Versions of the package `org.apache.tika:tika-parsers` before version 1.18 are vulnerable to Denial of Service (DoS) via a carefully crafted (or fuzzed) file that can trigger an infinite loop via the ChmParser.

Related

Alias · CVE (1)

  • CVE-2018-1339 A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18. vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References