PT-2018-11157 · Apache · Apache Tika

Published 2018-06-14 · Updated 2019-10-03 · CVE-2018-12418

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Junrar versions prior to 1.0.1

Description The issue is related to an infinite loop when handling corrupt RAR files, which can cause a denial of service. This affects products that use Junrar, such as Apache Tika.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the handling of RAR files to prevent potential denial of service attacks.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2018-12418

GHSA-5XQR-GRQ4-QWGX

Affected Products

Apache Tika

References · 7

• https://github.com/junrar/junrar/commit/ad8d0ba8e155630da8a1215cee3f253e0af45817 · Patch
• https://osv.dev/vulnerability/CVE-2018-12418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12418 · Security Note
• https://osv.dev/vulnerability/GHSA-5xqr-grq4-qwgx · Vendor Advisory
• https://github.com/junrar/junrar · Note
• https://github.com/junrar/junrar/pull/8 · Note
• https://github.com/advisories/GHSA-5xqr-grq4-qwgx · Note