Description

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

Remediation

References

https://access.redhat.com/errata/RHSA-2018:2669

https://lists.apache.org/thread.html/4d20c5748fb9f836653bc78a1bad991ba8485d82a1e821f70b641932%40%3Cdev.tika.apache.org%3E

Related Vulnerabilities

CVE-2021-23411 Vulnerability in npm package anchorme

CVE-2017-7674 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2022-45210 Vulnerability in maven package org.jeecgframework.boot:jeecg-module-system

CVE-2017-16099 Vulnerability in npm package no-case

CVE-2022-29229 Vulnerability in npm package cassproject

Severity

Medium

Classification

CWE-835 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Tags

Third Party Advisory