PT-2018-11157 · Apache · Apache Tika

Publicado 2018-06-14 · Atualizado 2019-10-03 · CVE-2018-12418

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Junrar versions prior to 1.0.1

Description The issue is related to an infinite loop when handling corrupt RAR files, which can cause a denial of service. This affects products that use Junrar, such as Apache Tika.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the handling of RAR files to prevent potential denial of service attacks.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2018-12418

GHSA-5XQR-GRQ4-QWGX

Produtos afetados

Apache Tika

Referências · 7

• https://github.com/junrar/junrar · Nota
• https://github.com/junrar/junrar/commit/ad8d0ba8e155630da8a1215cee3f253e0af45817 · Correção
• https://github.com/junrar/junrar/pull/8 · Nota
• https://osv.dev/vulnerability/CVE-2018-12418 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12418 · Nota de Segurança
• https://github.com/advisories/GHSA-5xqr-grq4-qwgx · Nota
• https://osv.dev/vulnerability/GHSA-5xqr-grq4-qwgx · Aviso do Fabricante