Linux Distros Unpatched Vulnerability : CVE-2018-11796

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Apache Tika 1.19 CVE-2018-11761, we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset after each parse, which,...

Important: Red Hat Security Advisory: Red Hat Fuse 7.5.0 security update

A minor version update from 7.4 to 7.5 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0) +1722 more potentially affected by CVE-2018-11796 via org.apache.tika:tika-core (>=0.4, <=1.19)

org.apache.tika:tika-core MAVEN version =0.4, =1.3, =1.0.0, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2018-11796 Source advisory: GHSA-H8Q5-G2CJ-QR5H...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0) +1722 more potentially affected by CVE-2018-11796 via org.apache.tika:tika-core (>=0.4, <=1.19)

org.apache.tika:tika-core MAVEN version =0.4, =1.3, =1.0.0, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2018-11796 Source advisory: MEND:CVE-2018-11796...

CVE-2018-11796

In Apache Tika 1.19 CVE-2018-11761, we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after...