CVE-2019-10093: Apache Tika - Allocation of Resources Without Limits or Throttling
Summary
CVE-2019-10093: Allocation of Resources Without Limits or Throttling in Apache Tika. Affects org.apache.tika:tika-parsers versions >= 1.19, < 1.22. Fixed in 1.22. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2019-10093 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tika is a popular open-source content analysis toolkit that provides a consistent interface for extracting metadata and text content from various file formats. It is widely used in applications that require parsing and analyzing different types of documents. The 'org.apache.tika:tika-parsers' package is a component of Apache Tika that handles the parsing of different file formats.
Vulnerability Detail
The vulnerability identified as CVE-2019-10093 affects Apache Tika versions 1.19 to 1.21. It involves a flaw where a specifically crafted 2003ml or 2006ml file can consume all available SAXParsers in the pool, leading to significant performance degradation or even complete hangs. This vulnerability can be exploited by an attacker to cause denial-of-service (DoS) conditions in applications utilizing Apache Tika. It is important to note that this vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.22
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The resource allocation vulnerability in Apache Tika versions 1.19 to 1.21 can be mitigated by upgrading to version 1.22 or later. By staying up to date with the latest releases, organizations can ensure the security and stability of their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika-parsers →
FAQ
Apache Tika is an open-source content analysis toolkit that enables developers to extract metadata and text content from various file formats.
Versions 1.19 to 1.21 of Apache Tika are vulnerable to this resource allocation issue.
Exploiting this vulnerability can lead to significant performance degradation or complete hangs in applications utilizing Apache Tika, potentially causing denial-of-service (DoS) conditions.
This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to Apache Tika version 1.22 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika-parsers.
