Apache Tika vulnerable to uncontrolled memory consumption

🗓️ 17 May 2022 00:00:36Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 33 Views

Apache Tika memory consumption vulnerabilit

Reporter	Title	Published	Views	Family All 32
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Tika	29 Jun 202202:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	26 Oct 202218:06	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tika security vulnerabilities found during Open Source Scan in IBM Content Collector for email in Content Search Services (affected, not vulnerable)	30 Dec 202221:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Log4j 1.x	3 Aug 202216:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis susceptible to multiple vulnerabilities in Apache Tika (CVE-2020-9489, CVE-2022-25169, CVE-2021-28657)	3 Nov 202208:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	5 Dec 202219:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis susceptible to vulnerability in Apache Tika (CVE-2022-25169)	21 Nov 202211:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities found in Apache Tika used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	24 Jun 202214:50	–	ibm
ATTACKERKB	CVE-2022-25169	16 May 202217:15	–	attackerkb

Vulners

Node

org.apache.tika tika_parsersRange2.0.0–2.4.0maven

OR

org.apache.tika tika_parsersRange<1.28.2maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-25169
lists	www.lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk
openwall	www.openwall.com/lists/oss-security/2022/05/16/4
oracle	www.oracle.com/security-alerts/cpujul2022.html
security	www.security.netapp.com/advisory/ntap-20220804-0004/
github	www.github.com/advisories/GHSA-7qcq-xp2f-56f6

31 Jan 2023 05:01Current

3.5Low risk

Vulners AI Score3.5

CVSS 24.3

CVSS 3.15.5

EPSS0.0027

CWE-400 CWE-770

apache tika memory consumption vulnerability bpg parser software