Описание
In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| tika | fixed | 1.22-1 | package | |
| tika | no-dsa | buster | package | |
| tika | not-affected | jessie | package |
Примечания
https://www.openwall.com/lists/oss-security/2019/08/02/3
https://github.com/apache/tika/commit/81c21ab0aac6b3e4102a1a8906c8c7eab6f96dae
Связанные уязвимости
In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
Allocation of Resources Without Limits or Throttling in Apache Tika
Уязвимость среды обнаружения и анализа контента Apache Tika, связанная с неконтролируемым расходом ресурса, позволяющая нарушителю вызвать отказ в обслуживании