Bug 13330

Please patch CVEs for package tika version 1.17
  
INFO (CVEs are): tika 1.17
 cves found
CVE-2018-11761
Desc: In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-11761
Severity: HIGH
CVE-2018-11762
Desc: In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-11762
Severity: MEDIUM
CVE-2018-11796
Desc: In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-11796
Severity: HIGH
CVE-2018-1335
Desc: From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1335
Severity: HIGH
CVE-2018-1338
Desc: A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1338
Severity: MEDIUM
CVE-2018-1339
Desc: A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1339
Severity: MEDIUM
CVE-2018-17197
Desc: A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-17197
Severity: MEDIUM
CVE-2018-8017
Desc: In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
Link: https://nvd.nist.gov/vuln/detail/CVE-2018-8017
Severity: MEDIUM
CVE-2019-10088
Desc: A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
Link: https://nvd.nist.gov/vuln/detail/CVE-2019-10088
Severity: HIGH
CVE-2019-10094
Desc: A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
Link: https://nvd.nist.gov/vuln/detail/CVE-2019-10094
Severity: HIGH
CVE-2020-1950
Desc: A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1950
Severity: MEDIUM
CVE-2020-1951
Desc: A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1951
Severity: MEDIUM
CVE-2022-25169
Desc: The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-25169
Severity: MEDIUM
CVE-2022-30126
Desc: In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-30126
Severity: MEDIUM
CVE-2022-30973
Desc: We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-30973
Severity: MEDIUM
CVE-2022-33879
Desc: The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-33879
Severity: LOW