5.5med
CVE-2018-1339
org.apache.tika:tika-parsers has an Infinite Loop vulnerability
Also known as GHSA-p699-3wgc-7h72
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.6%
percentile 85%
Public exploits
0
none known
Summary
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Exploit prediction (EPSS)
2.56% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
| GitHub | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.tika:tika-parsers | <1.18 | 1.18 |
Affected products
- Apache Software Foundation Apache Tika
Classification
- Weakness
- CWE-835 Loop with Unreachable Exit Condition
References
- access.redhat.com /errata/RHSA-2018:2669 · vendor-advisory, x_refsource_REDHAT, x_transferred
- lists.apache.org /thread.html/4d2cb5c819401bb075e2a1130e0d14f0404a136541a6f91da0225828%40%3Cdev.tika.apache · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-1339 · advisory
- github.com /apache/tika/commit/1b6ca3685c196cfd89f5f95c19cc919ce10c5aff#diff-43f8cbe58aaab159ce88bd95 · web
- github.com /apache/tika · package
- lists.apache.org /thread.html/4d2cb5c819401bb075e2a1130e0d14f0404a136541a6f91da0225828@%3Cdev.tika.apache.o · web
Sources
- CVE List: CVE-2018-1339
- GitHub Advisory: GHSA-p699-3wgc-7h72
- NVD: CVE-2018-1339
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.