Filtered by vendor Apache Subscriptions
Filtered by product Tika Subscriptions

Search

Switch to Advanced Search (Beta)
Total 23 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-11796 2 Apache, Redhat 2 Tika, Jboss Fuse 2024-11-21 N/A
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
CVE-2018-11762 1 Apache 1 Tika 2024-11-21 N/A
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
CVE-2018-11761 2 Apache, Oracle 2 Tika, Business Process Management Suite 2024-11-21 N/A
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.