PT-2019-4680 · Apache+1 · Apache Tika+1

Publicado 2019-08-02 · Atualizado 2020-08-24 · CVE-2019-10093

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Tika versions 1.19 through 1.21

Description The issue is related to an uncontrolled resource consumption in Apache Tika. A carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool, leading to very long hangs. This could allow a remote attacker to cause a denial of service.

Recommendations For Apache Tika versions 1.19 through 1.21, upgrade to version 1.22 or later to resolve the issue.

Correção

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

BDU:2020-01012

CVE-2019-10093

GHSA-4MQ5-MJ59-QQ9C

SUSE-SU-2019:2521-1

SUSE-SU-2019:2930-1

Produtos afetados

Apache Tika

Suse

Referências · 94

• https://bugzilla.suse.com/1096426 · Nota
• https://bugzilla.suse.com/1145086 · Nota
• https://bugzilla.suse.com/1150180 · Nota
• https://bugzilla.suse.com/1150113 · Nota
• https://bugzilla.suse.com/1150729 · Nota
• https://bugzilla.suse.com/1135442 · Nota
• https://lists.apache.org/thread.html/a5a44eff1b9eda3bc69d22943a1030c43d376380c75d3ab04d0c1a21@%3Cdev.tika.apache.org%3E · Nota
• https://bugzilla.suse.com/1149075 · Nota
• https://bugzilla.suse.com/1146419 · Nota
• https://bugzilla.suse.com/1140644 · Nota
• https://oracle.com/security-alerts/cpujan2020.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10093 · Nota de Segurança
• https://bugzilla.suse.com/1151481 · Nota
• https://bugzilla.suse.com/1147126 · Nota
• https://bugzilla.suse.com/1152290 · Nota