WaratekVRT Sign in

High Org.apache.tika CVEs

6 CVEs, 1 exploited, 4 protected by Waratek

Reset
More filters (1)
Columns
Vendor org.apache.tika✕
Overview 6 matches · 4 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
6matches 4protected66.7% 1exploited16.7% 0CISA KEV0.0% 2public PoC33.3% 1EPSS ≥ 0.516.7%
Protected by Waratek 4 66.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 33.3%
Critical 0 0.0% High 6 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 66.7% partly blocked 0 0.0% not blocked 2 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 16.7% Working exploit published 0 0.0% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 4 66.7%
split by peak 2 / quarter
No exploit published: 2Protected by Waratek: 4 High: 6 not blocked: 2blocked by ARMR today: 4 No public exploit: 4Proof of concept only: 1Exploited: 1
Q3 171 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 170 Q1 180 Q2 181 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q3 181 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 Q4 181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q1 190 Q2 190 Q3 192 No exploit published2 High2 not blocked2 No public exploit2
Q3 17Q4 17Q1 18Q2 18Q3 18Q4 18Q1 19Q2 19Q3 19
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-10094 High 2019-08-02 No exploit published No public exploit A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
CVE-2019-10088 High 2019-08-02 No exploit published No public exploit A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
CVE-2018-11796 High 2018-10-09 Protected by Waratek No public exploit In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
CVE-2018-11761 High 2018-09-19 Protected by Waratek Proof of concept only In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
CVE-2018-1335 High 2018-04-25 Protected by Waratek Exploited From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
CVE-2016-4434 High 2017-09-30 Protected by Waratek No public exploit Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.