[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAC1dCwWXeiCT8i9S1LqX8V6bJTyn0frFbciJmQFczuMO9JPA-Q@mail.gmail.com>
Date: Fri, 2 Aug 2019 07:34:26 -0400
From: Tim Allison <tallison@...che.org>
To: announce@...che.org, dev@...a.apache.org, user@...a.apache.org,
oss-security@...ts.openwall.com
Subject: [CVE-2019-10093] Denial of Service in Apache Tika's 2003ml and 2006ml Parsers
Title: [CVE-2019-10093] Denial of Service in Apache Tika's 2003ml and
2006ml Parsers
Severity: Medium
Vendor: The Apache Software Foundation
Versions Affected: Apache Tika 1.19 to 1.21
Description:
A carefully crafted 2003ml or 2006ml file could consume all available
SAXParsers in the pool and lead to very long hangs.
Mitigation:
Apache Tika users should upgrade to 1.22 or later.
Credit:
This issue was discovered by Tim Allison on the Apache Tika team.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
