CVE-2018-1339: Denial of Service (DoS) vulnerability in org.apache.tika:tika-parsers
Summary
CVE-2018-1339: org.apache.tika:tika-parsers has an Infinite Loop vulnerability. Affects org.apache.tika:tika-parsers versions < 1.18. Fixed in 1.18. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2018-1339 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.tika:tika-parsers is a package in the Maven ecosystem that provides parsers for various file formats. It is used to extract metadata and content from files. The package is vulnerable to a Denial of Service (DoS) attack through a carefully crafted file that triggers an infinite loop in the ChmParser.
Vulnerability Detail
The vulnerability in org.apache.tika:tika-parsers allows an attacker to cause a DoS condition by providing a specially crafted file. When this file is processed by the ChmParser, it triggers an infinite loop, consuming excessive CPU resources and causing the application to become unresponsive. This vulnerability can be exploited remotely without authentication. The impact of this vulnerability is a complete denial of service, rendering the affected application unavailable.
How To Fix
Minimum fixed version
1.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to a non-vulnerable version of org.apache.tika:tika-parsers.
Conclusion
The vulnerability in org.apache.tika:tika-parsers can be exploited to cause a denial of service condition in the affected application. It is crucial to upgrade to a non-vulnerable version of the package to mitigate this risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika-parsers →
FAQ
org.apache.tika:tika-parsers is a package in the Maven ecosystem that provides parsers for various file formats. It is used to extract metadata and content from files.
The impact of this vulnerability is a complete denial of service, rendering the affected application unavailable.
Yes, this vulnerability can be exploited remotely without authentication.
No, there is no known workaround. It is essential to apply the fix by upgrading to a non-vulnerable version of org.apache.tika:tika-parsers.
To fix this vulnerability, upgrade to version 1.18 or later of org.apache.tika:tika-parsers.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika-parsers.
