Skip to content
OpenAdvisories
High · 7.8 CVE-2019-10094 EUVD-2019-0639GHSA-mm7m-xg4h-6m52

Allocation of Resources Without Limits or Throttling in Apache Tika

Published Aug 2, 2019 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Product: Apache Tika Package: org.apache.tika:tika-core Package: tika Ecosystem: Debian Ecosystem: Maven

Description

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.

Affected products

VendorProductAffectedFixed
Apache Apache Tika 1.7 to 1.21 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 11 tika 1.22-1 —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.0 cobbler 3.0.0+git20190806.32c4bae0-7.3.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 cpu-mitigations-formula 0.1-4.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 mgr-osad +1 4.0.10-3.6.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 patterns-suse-manager 4.0-9.3.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 pgjdbc-ng 0.7.1-3.3.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 prometheus-exporters-formula 0.4-3.3.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 pxe-default-image-sle15 4.0.0-20191106084601 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 py26-compat-salt 2016.11.10-10.8.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 python-susemanager-retail 1.0.1568808472.be9f236-3.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 python-urlgrabber 3.10.2.1py2_3-6.22.6 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacecmd 4.0.16-3.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-admin 4.0.8-3.3.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-backend 4.0.27-3.13.9 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-branding 4.0.14-3.6.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-certs-tools 4.0.12-3.6.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-config 4.0.13-3.3.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-java 4.0.25-3.10.5 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-setup 4.0.11-3.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-utils 4.0.13-3.6.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 spacewalk-web 4.0.16-3.9.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager 4.0.17-3.6.9 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-doc-indexes 4.0-10.9.8 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-docs_en 4.0-10.9.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-schema 4.0.16-3.8.5 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-sls 4.0.22-3.10.4 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 susemanager-sync-data 4.0.13-3.6.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 tika-core 1.22-3.3.7 SUSE-SU-2019:2930-1
SUSE Manager Server Module 4.0 virtual-host-gatherer 1.0.19-3.3.8 SUSE-SU-2019:2930-1
SUSE Manager Server 3.2 cobbler 2.6.6-6.22.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 pgjdbc-ng 0.7.1-2.6.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 py26-compat-salt 2016.11.10-6.32.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacecmd 2.8.25.11-3.23.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-backend 2.8.57.19-3.39.2 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-branding 2.8.5.16-3.22.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-client-tools 2.8.22.5-3.6.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-java 2.8.78.24-3.38.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-setup 2.8.7.8-3.19.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-utils 2.8.18.5-3.9.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 spacewalk-web 2.8.7.19-3.36.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 susemanager 3.2.20-3.31.2 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 susemanager-docs_en 3.2-11.32.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 susemanager-schema 3.2.21-3.31.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 susemanager-sls 3.2.27-3.35.1 SUSE-SU-2019:2521-1
SUSE Manager Server 3.2 tika-core 1.22-3.9.1 SUSE-SU-2019:2521-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tika:tika-core >= 1.7, < 1.22 1.22 GHSA-mm7m-xg4h-6m52

Advisories 2

References