Infinite Loop Vulnerability in Apache Tika's ChmParser
Summary
CVE-2018-1339: A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18. Affects tika across 2 version ranges.
< 1.18-1
< 38ff2a986af24ee255f1f91d654ea402f4016696
Fixed in 1.18-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tika is an open-source content analysis toolkit that is used to extract metadata and text from various file formats. The ChmParser module in Apache Tika is responsible for parsing CHM (Compiled HTML Help) files. CHM files are commonly used for documentation and help files on Windows systems. This vulnerability affects versions of Apache Tika before 1.18.
Vulnerability Detail
A carefully crafted or fuzzed file can trigger an infinite loop in Apache Tika's ChmParser. This vulnerability can be exploited by an attacker to cause a denial of service (DoS) condition by consuming excessive CPU resources. By sending a malicious CHM file to an application that uses Apache Tika, an attacker can cause the application to hang or become unresponsive.
How To Fix
Minimum fixed version
1.18-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tikaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update Apache Tika to the latest version as soon as possible.
Conclusion
In summary, the Infinite Loop Vulnerability in Apache Tika's ChmParser can be exploited to cause a denial of service condition. It is recommended to update Apache Tika to version 1.18 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tika →
FAQ
Apache Tika is an open-source content analysis toolkit that is used to extract metadata and text from various file formats.
A CHM (Compiled HTML Help) file is a file format commonly used for documentation and help files on Windows systems.
This vulnerability can be exploited by an attacker to cause a denial of service (DoS) condition by consuming excessive CPU resources. It can lead to application hang or unresponsiveness.
To fix this vulnerability, update Apache Tika to version 1.18 or later.
There is no known workaround for this vulnerability. It is recommended to update Apache Tika to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for tika.
