CVE-2018-17197: org.apache.tika:tika-core - Infinite Loop in SQLite3Parser
Summary
CVE-2018-17197: Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser. Affects org.apache.tika:tika-parsers versions >= 1.8, < 1.20. Fixed in 1.20. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2018-17197 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
org.apache.tika:tika-core is a Maven package that provides core functionality for Apache Tika, a toolkit for detecting and extracting metadata and structured text content from various file formats. It is widely used in applications that require content analysis and data extraction. However, versions 1.8-1.19.1 of Apache Tika's SQLite3Parser are vulnerable to an infinite loop when processing a carefully crafted or corrupt SQLite file.
Vulnerability Detail
The vulnerability in Apache Tika's SQLite3Parser allows an attacker to trigger an infinite loop by providing a specially crafted or corrupted SQLite file. This can lead to a denial of service (DoS) condition, where the affected application becomes unresponsive or crashes. The vulnerability affects versions 1.8-1.19.1 of Apache Tika.
How To Fix
Minimum fixed version
1.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of org.apache.tika:tika-core to address the issue.
Conclusion
In conclusion, the vulnerability in org.apache.tika:tika-core's SQLite3Parser can lead to a denial of service (DoS) condition in the affected application. It is crucial to upgrade to version 1.20 or later of the package to mitigate this vulnerability. For further support and assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika-parsers →
FAQ
org.apache.tika:tika-core is a Maven package that provides core functionality for Apache Tika, a toolkit for content analysis and data extraction from various file formats.
The vulnerability can cause an infinite loop in Apache Tika's SQLite3Parser, leading to a denial of service (DoS) condition in the affected application.
Versions 1.8-1.19.1 of Apache Tika's SQLite3Parser are affected by this vulnerability.
No, there is no known workaround. It is necessary to upgrade to a fixed version of org.apache.tika:tika-core.
To fix this vulnerability, upgrade to version 1.20 or later of org.apache.tika:tika-core.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika-parsers.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
