PT-2022-20430 · Apache+3 · Apache Tika+3

Cathy Hu · CVE-2022-30973 · Published 2022-05-31 · Updated 2025-05-23

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Tika versions 1.x through 1.28.2

Description A denial of service issue exists due to a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler, which can lead to backtracking on a specially crafted file. This issue only affects users running the StandardsExtractingContentHandler, a non-standard handler.

Recommendations For Apache Tika versions 1.x through 1.28.2, update to version 1.28.3 to resolve the issue. As a temporary workaround, consider disabling the StandardsExtractingContentHandler until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2022-30973

GHSA-QW3F-W4PF-JH5F

SUSE-SU-2022:3310-1

SUSE-SU-2022:3311-1

USN-7529-1

Affected Products

Apache Tika

Linuxmint

Suse

Ubuntu

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30973.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-30973 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-33879 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7529-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7529-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3311-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-1950 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qw3f-w4pf-jh5f · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-30973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30973 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-30973 · Security Note
• https://lists.apache.org/thread/gqvb5t4p7tmdpl0y5bdbf72pgxj04h7p · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-1951 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30973 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30126 · Vendor Advisory