https://bugzilla.redhat.com/show_bug.cgi?id=1639090
Bug ID: 1639090
Summary: CVE-2018-11796 tika: Incomplete fix allows for XML
entity expansion resulting in denial of service
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: abergmann(a)suse.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, anstephe(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lpetrovi(a)redhat.com, mat.booth(a)redhat.com,
meissner(a)suse.de, nwallace(a)redhat.com,
paradhya(a)redhat.com, pszubiak(a)redhat.com,
puntogil(a)libero.it, rrajasek(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, vhalbert(a)redhat.com
Apache Tika 1.19 included an incomplete fix for CVE-2018-11761 which added an
entity expansion limit for XML parsing. However, Tika reuses SAXParsers and
calls reset() after each parse, which, for Xerces2 parsers, as per the
documentation, removes the user-specified SecurityManager and thus removes
entity expansion limits after the first parse. Apache Tika 1.19 is therefore
still vulnerable to entity expansions which can lead to a denial of service
attack.
External Reference:
https://lists.apache.org/thread.html/88de8350cda9b184888ec294c813c5bd8a20...
Upstream Issue:
https://issues.apache.org/jira/projects/TIKA/issues/TIKA-2727
Upstream Patch:
https://github.com/apache/tika/commit/86d4ba1e
--
You are receiving this mail because:
You are on the CC list for the bug.