Skip to content
OpenAdvisories
Medium · 6.5 CVE-2019-10093 EUVD-2019-0618GHSA-4mq5-mj59-qq9c

Allocation of Resources Without Limits or Throttling in Apache Tika

Published Aug 2, 2019 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Product: Apache Tika Package: org.apache.tika:tika-parsers Package: tika Ecosystem: Debian Ecosystem: Maven

Description

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.

Affected products

VendorProductAffectedFixed
Apache Apache Tika 1.19 to 1.21 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 11 tika 1.22-1 —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.0 cobbler 3.0.0+git20190806.32c4bae0-7.3.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 cpu-mitigations-formula 0.1-4.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 mgr-osad +1 4.0.10-3.6.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 patterns-suse-manager 4.0-9.3.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 pgjdbc-ng 0.7.1-3.3.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 prometheus-exporters-formula 0.4-3.3.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 pxe-default-image-sle15 4.0.0-20191106084601 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 py26-compat-salt 2016.11.10-10.8.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 python-susemanager-retail 1.0.1568808472.be9f236-3.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 python-urlgrabber 3.10.2.1py2_3-6.22.6 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacecmd 4.0.16-3.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-admin 4.0.8-3.3.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-backend 4.0.27-3.13.9 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-branding 4.0.14-3.6.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-certs-tools 4.0.12-3.6.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-config 4.0.13-3.3.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-java 4.0.25-3.10.5 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-setup 4.0.11-3.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-utils 4.0.13-3.6.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-web 4.0.16-3.9.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager 4.0.17-3.6.9 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-doc-indexes 4.0-10.9.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-docs_en 4.0-10.9.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-schema 4.0.16-3.8.5 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-sls 4.0.22-3.10.4 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-sync-data 4.0.13-3.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 tika-core 1.22-3.3.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 virtual-host-gatherer 1.0.19-3.3.8 SUSE-SU-2019:2930-1
SUSE Manager Server 3.2 cobbler 2.6.6-6.22.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 pgjdbc-ng 0.7.1-2.6.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 py26-compat-salt 2016.11.10-6.32.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacecmd 2.8.25.11-3.23.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-backend 2.8.57.19-3.39.2 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-branding 2.8.5.16-3.22.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-client-tools 2.8.22.5-3.6.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-java 2.8.78.24-3.38.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-setup 2.8.7.8-3.19.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-utils 2.8.18.5-3.9.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-web 2.8.7.19-3.36.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 susemanager 3.2.20-3.31.2 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 susemanager-docs_en 3.2-11.32.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 susemanager-schema 3.2.21-3.31.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 susemanager-sls 3.2.27-3.35.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 tika-core 1.22-3.9.1 SUSE-SU-2019:2521-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tika:tika-parsers >= 1.19, < 1.22 1.22 GHSA-4mq5-mj59-qq9c

Advisories 2

References