PT-2018-13947 · Apache · Apache Tika

Published 2018-12-24 · Updated 2019-10-03 · CVE-2018-17197

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Tika versions 1.8 through 1.19.1

Description A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser.

Recommendations For Apache Tika versions 1.8 through 1.19.1, update to a version that contains a fix for this issue to prevent an infinite loop caused by a corrupt sqlite file.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2018-17197

GHSA-3448-VFVV-XP9G

SUSE-RU-2019:0341-1

SUSE-RU-2019:0863-1

SUSE-SU-2019:0341-1

SUSE-SU-2019:0863-1

Affected Products

Apache Tika

References · 84

• https://nvd.nist.gov/vuln/detail/CVE-2018-17197 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2019:0341-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-17197 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0863-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17197 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3448-vfvv-xp9g · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2019:0863-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17197 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-17197 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0341-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17197 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-17197 · Vendor Advisory
• https://bugzilla.suse.com/1129765 · Note
• https://bugzilla.suse.com/1121424 · Note
• https://bugzilla.suse.com/1111686 · Note