Описание
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
It was found that the parsing of OOXML, XMP in PDF, and some other file formats by Apache Tika would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | tika-core | Affected | ||
| Red Hat JBoss BRMS 5 | tika-core | Will not fix | ||
| Red Hat JBoss BRMS 6 | tika-core | Affected | ||
| Red Hat JBoss Fuse Service Works 6 | tika | Not affected | ||
| Red Hat JBoss Portal 6 | tika-core | Will not fix | ||
| Red Hat Satellite 5 | tika | Under investigation | ||
| Red Hat JBoss BPMS 6.4 | Fixed | RHSA-2017:0249 | 02.02.2017 | |
| Red Hat JBoss BRMS 6.4 | Fixed | RHSA-2017:0248 | 02.02.2017 | |
| Red Hat JBoss Data Virtualization 6.3 | tika-core | Fixed | RHSA-2017:0272 | 14.02.2017 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
5.8 Medium
CVSS2
Связанные уязвимости
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
Apache Tika before 1.13 does not properly initialize the XML parser or ...
Apache Tika does not properly initialize the XML parser or choose handlers
EPSS
5.4 Medium
CVSS3
5.8 Medium
CVSS2