PT-2019-4680 · Apache+1 · Apache Tika+1

Published 2019-08-02 · Updated 2020-08-24 · CVE-2019-10093

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Tika versions 1.19 through 1.21

Description The issue is related to an uncontrolled resource consumption in Apache Tika. A carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool, leading to very long hangs. This could allow a remote attacker to cause a denial of service.

Recommendations For Apache Tika versions 1.19 through 1.21, upgrade to version 1.22 or later to resolve the issue.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

BDU:2020-01012

CVE-2019-10093

GHSA-4MQ5-MJ59-QQ9C

SUSE-SU-2019:2521-1

SUSE-SU-2019:2930-1

Affected Products

Apache Tika

Suse

References · 94

• https://nvd.nist.gov/vuln/detail/CVE-2019-10093 · Security Note
• https://bdu.fstec.ru/vul/2020-01012 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-10093 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10093 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2930-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4mq5-mj59-qq9c · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10093 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2521-1 · Vendor Advisory
• https://bugzilla.suse.com/1096426 · Note
• https://bugzilla.suse.com/1145086 · Note
• https://bugzilla.suse.com/1150180 · Note
• https://bugzilla.suse.com/1150113 · Note
• https://bugzilla.suse.com/1150729 · Note
• https://bugzilla.suse.com/1135442 · Note
• https://lists.apache.org/thread.html/a5a44eff1b9eda3bc69d22943a1030c43d376380c75d3ab04d0c1a21@%3Cdev.tika.apache.org%3E · Note