SB2022051837 - Multiple vulnerabilities in Apache Tika

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2022-25169)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in BPG parser. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

2) Incorrect Regular Expression (CVE-ID: CVE-2022-30126)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to improper validation in the StandardsText class. A remote attacker can pass specially crafted file to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk
• http://www.openwall.com/lists/oss-security/2022/05/16/4
• https://lists.apache.org/thread/dh3syg68nxogbmlg13srd6gjn3h2z6r4
• http://www.openwall.com/lists/oss-security/2022/05/16/3