Infinite Loop Vulnerability in Apache Tika's SQLite3Parser (CVE-2018-17197)
Summary
CVE-2018-17197: A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika. Affects tika across 2 version ranges.
< 1.20-1
>= c57e805ee506123afc208eae5fd97fb4c4d1b8f7, <= 3c2c4101312aa5bf4f466638b4eec03a1ac9878b
Fixed in 1.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tika is a versatile toolkit designed for content detection and analysis. It enables users to extract text and metadata from various file formats, making it invaluable for applications that require document processing. The SQLite3Parser component of Tika is responsible for parsing SQLite database files. However, certain versions of Tika (1.8 to 1.19.1) are susceptible to a vulnerability that can lead to an infinite loop when processing malformed SQLite files.
Vulnerability Detail
The vulnerability, identified as CVE-2018-17197, arises from the handling of specially crafted or corrupt SQLite files by the SQLite3Parser in Apache Tika. When such a file is processed, it can trigger an infinite loop, causing the application to hang indefinitely. This issue can lead to denial of service, as the affected application may become unresponsive, impacting users and potentially leading to data loss or corruption. The vulnerability affects versions 1.8 through 1.19.1 of Apache Tika, necessitating immediate attention from users of these versions.
How To Fix
Minimum fixed version
1.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tikaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to avoid processing untrusted or potentially corrupt SQLite files with the affected versions of Apache Tika. Additionally, implementing input validation to check the integrity of SQLite files before processing can help mitigate the risk.
Conclusion
CVE-2018-17197 represents a significant risk for users of Apache Tika versions 1.8 to 1.19.1, as it can lead to application unresponsiveness when processing malformed SQLite files. Users are strongly advised to upgrade to version 1.20 or later to mitigate this risk. For those unable to upgrade immediately, implementing workarounds can help reduce exposure to this vulnerability.
See every vulnerability recorded for tika →
FAQ
CVE-2018-17197 is a vulnerability in Apache Tika's SQLite3Parser that can cause an infinite loop when processing malformed SQLite files.
The vulnerability affects Apache Tika versions 1.8 through 1.19.1.
The primary consequence is denial of service, as the application may hang indefinitely when processing a malicious SQLite file.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2018-17197 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tika.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
