Denial of Service Vulnerability in Apache POI (libapache-poi-java) Prior to Version 3.17
Summary
CVE-2017-12626: Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while... Affects libapache-poi-java across 2 version ranges.
< 3.17-1
< ab700dc2ae3a880f66a10075cbf1a502da928afb
Fixed in 3.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a widely used Java library that enables developers to create, modify, and display Microsoft Office documents such as Word, Excel, and PowerPoint. It provides a robust API for handling various file formats, making it essential for applications that require document manipulation. However, versions prior to 3.17 are susceptible to specific Denial of Service (DoS) attacks due to flaws in parsing certain crafted file formats.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12626, arises from Apache POI's handling of crafted WMF, EMF, MSG, DOC, PPT, and XLS files. Attackers can exploit this vulnerability by sending specially crafted files that trigger infinite loops or cause Out of Memory exceptions during parsing. This can lead to service disruptions, making the application unresponsive or crashing it entirely. The vulnerability affects multiple versions of the libapache-poi-java package across various Debian ecosystems.
How To Fix
Minimum fixed version
3.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache-poi-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to filter out potentially malicious files before they are processed by the Apache POI library. This can help prevent the exploitation of the vulnerability until a proper update can be applied.
Conclusion
CVE-2017-12626 is a critical vulnerability in Apache POI that can lead to Denial of Service attacks. It is essential for users of the libapache-poi-java package to update to version 3.17 or later to protect their applications from potential exploitation. Implementing input validation can serve as a temporary workaround until an update is applied.
See every vulnerability recorded for libapache-poi-java →
FAQ
CVE-2017-12626 is a vulnerability in Apache POI that allows attackers to cause Denial of Service through crafted document files.
All versions of Apache POI prior to 3.17 are affected by this vulnerability.
Exploitation of this vulnerability can lead to infinite loops or Out of Memory exceptions, resulting in application crashes or unresponsiveness.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-12626 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
