Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
Recommended action: Upgrade to 2.4.1 or 1.28.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
Recommended action: Upgrade to 2.4.0 or 1.28.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
Recommended action: Upgrade to 1.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
Recommended action: Upgrade to 1.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Recommended action: Upgrade to 1.24.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.