Regular Expression Denial Of Service (ReDoS)

🗓️ 28 Jun 2022 08:35:27Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 31 Views

org.apache.tika:tika is vulnerable to ReDoS attacks in `StandardsExtractingContentHandler` component due to insecure regex usage in `setThreshold` function, causing denial of service conditions. Incomplete fixes for `CVE-2022-30126` and `CVE-2022-30973`

Reporter	Title	Published	Views	Family All 99
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Tika	29 Jun 202202:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	26 Oct 202218:06	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tika security vulnerabilities found during Open Source Scan in IBM Content Collector for email in Content Search Services (affected, not vulnerable)	30 Dec 202221:53	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Apache Tika used by Content Collector for Email in Content Search Services container (affected, not vulnerable)	2 Nov 202216:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Tika	3 Aug 202219:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	5 Dec 202219:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	5 Dec 202219:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis vulnerable to multiple vulnerabilities in Apache Tika (CVE-2022-30126, CVE-2022-33879, CVE-2022-30973)	17 Nov 202216:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	12 Jan 202317:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities found in Apache Tika used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections	24 Jun 202214:50	–	ibm

Vulners

Node

apache tika-coreRange2.0.0-ALPHA–2.4.0java

apache tika-coreRange1.17–1.28.3java

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/06/27/5
github	www.github.com/apache/tika/commit/22f763a3f14f9a47e46212a74b2a5d4339de6ab5
sca	www.sca.analysiscenter.veracode.com/vulnerability-database/security/denial-of-service-dos-/java/sid-35567
sca	www.sca.analysiscenter.veracode.com/vulnerability-database/security/regular-expression-denial-of-service-redos-/java/sid-35785
security	www.security.netapp.com/advisory/ntap-20220812-0004/
github	www.github.com/apache/tika/commit/3f0078639e9b15de7f5f8293df9222fdc1505fe0
openwall	www.openwall.com/lists/oss-security/2022/06/27/5
lists	www.lists.apache.org/thread/wfno8mf5nlcvbs78z93q9thgrm30wwfh

28 Oct 2022 14:17Current

5.3Medium risk

Vulners AI Score5.3

CVSS 24.3

CVSS 3.15.5

EPSS0.00536