CVE-2022-33879: Apache Tika Incomplete Fix for Regex DoS
Summary
CVE-2022-33879: Apache Tika contains incomplete fix for regex DoS. Affects org.apache.tika:tika across 2 version ranges.
< 1.28.4
>= 2.0.0, < 2.4.1
Fixed in 1.28.4 or 2.4.1, depending on the release line you run. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2022-33879 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tika is an open-source content analysis toolkit that is used to extract metadata and text from various file formats. It provides a unified interface for parsing different types of files, such as documents, images, and audio files. The package 'org.apache.tika:tika' is a Maven package that includes the Apache Tika library. This vulnerability affects versions 0 to 1.28.3 and 2.0.0 to 2.4.0 of the package.
Vulnerability Detail
The Apache Tika package contains a regex Denial of Service (DoS) vulnerability. The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and a separate regex DoS vulnerability was discovered in a different regex in the StandardsExtractingContentHandler. This vulnerability can be exploited by an attacker to cause a DoS condition by providing specially crafted input. The impact of this vulnerability is limited to a DoS attack and does not allow for remote code execution or unauthorized access to sensitive information. The vulnerability has been assigned a CVSS score of 3.3, indicating a low severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.28.41.28.4 -
>= 2.0.0, < 2.4.12.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the package to the latest version.
Conclusion
The Apache Tika package contains a regex DoS vulnerability that can be mitigated by updating to version 1.28.4 or 2.4.1 of the 'org.apache.tika:tika' package. This vulnerability allows for a DoS attack but does not pose a risk of remote code execution or unauthorized access to sensitive information. It is important to promptly update the package to ensure the security of the application.
See every vulnerability recorded for org.apache.tika:tika →
FAQ
Apache Tika is an open-source content analysis toolkit used for extracting metadata and text from various file formats.
The vulnerability allows for a Denial of Service (DoS) attack, causing the affected application to become unresponsive.
No, this vulnerability only allows for a DoS attack and does not enable remote code execution or unauthorized access to sensitive information.
To fix this vulnerability, update the 'org.apache.tika:tika' package to version 1.28.4 or 2.4.1, depending on the version being used.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by updating the package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika.
