Denial of Service Vulnerability in Apache Tika (CVE-2019-10093)
Summary
CVE-2019-10093: In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Affects tika across 2 version ranges.
< 1.22-1
>= 199112bde63e64af3de7ec8c98475907e7513128, <= 7d4dd43eb40a500663b2bdd38f0a9ccb0569c1d7
Fixed in 1.22-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tika is a content analysis toolkit that enables the extraction of text and metadata from various document formats. It is widely used for parsing and indexing documents in applications that require document management and search capabilities. The toolkit supports a broad range of file types, making it a versatile choice for developers. However, versions 1.19 to 1.21 of Apache Tika are susceptible to a Denial of Service (DoS) vulnerability, which can be exploited through specially crafted XML files.
Vulnerability Detail
The vulnerability, identified as CVE-2019-10093, arises from the handling of 2003ml or 2006ml files. An attacker can create a malicious file that, when processed by Apache Tika, consumes all available SAXParsers in the pool. This can lead to prolonged hangs in the application, effectively causing a Denial of Service. The issue is rooted in the way Tika manages its parser resources, which can be overwhelmed by the crafted input, resulting in significant performance degradation.
How To Fix
Minimum fixed version
1.22-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tikaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing resource limits on the application to mitigate the impact of the vulnerability. This can be done by configuring the application server to restrict the number of SAXParsers that can be instantiated or by monitoring the application for unusual behavior when processing XML files.
Conclusion
CVE-2019-10093 poses a significant risk to users of Apache Tika versions 1.19 to 1.21, allowing for Denial of Service attacks through specially crafted XML files. It is crucial for users to upgrade to version 1.22 or later to mitigate this vulnerability. In the meantime, implementing resource limits can help reduce the risk of exploitation.
See every vulnerability recorded for tika →
FAQ
CVE-2019-10093 is a vulnerability in Apache Tika that allows attackers to create specially crafted XML files that can exhaust parser resources, leading to Denial of Service.
Versions 1.19 to 1.21 of Apache Tika are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2019-10093 is 6.5, indicating a medium severity level.
If you cannot upgrade immediately, consider implementing resource limits on your application or monitoring for unusual behavior when processing XML files.
Related vulnerabilities
Recent vulnerabilities recorded for tika.
