In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 11 | all | tika | < 1.20-1 | tika_1.20-1_all.deb |
Debian | 10 | all | tika | < 1.20-1 | tika_1.20-1_all.deb |
Debian | 999 | all | tika | < 1.20-1 | tika_1.20-1_all.deb |