Описание
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
An XML External Entity injection flaw was found in the Apache Tika tika-parser-pdf-module. This vulnerability allows an attacker to provide a crafted XFA file within a PDF, read sensitive data, or trigger malicious requests to internal resources or third-party servers.
Отчет
Within Red Hat products, the tika-parser-pdf-module is exclusively used for testing purposes at build time, it is not included in any shipped releases of Camel Spring Boot or JBoss EAP.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel for Spring Boot 4 | tika-parser-pdf-module | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | tika-parser-pdf-module | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | tika-parser-pdf-module | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | tika-parser-pdf-module | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
9.4 Critical
CVSS3
Связанные уязвимости
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1. ...
Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF
Уязвимость модулей tika-core, tika-pdf-module и tika-parsers среды обнаружения и анализа контента Apache Tika, позволяющая нарушителю проводить XXE-атаки
EPSS
9.4 Critical
CVSS3