What is GHSA-6q8v-2hvm-fx37?

GHSA-6q8v-2hvm-fx37 is a security advisory published by GitHub Security Advisories with Low severity. Apache Tika contains incomplete fix for regex DoS

Which CVE IDs does GHSA-6q8v-2hvm-fx37 cover?

GHSA-6q8v-2hvm-fx37 covers the following CVE IDs: CVE-2022-33879. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6q8v-2hvm-fx37?

GHSA-6q8v-2hvm-fx37 has a CVSS v3 base score of 3.3, published by GitHub Security Advisories.

Which products are affected by GHSA-6q8v-2hvm-fx37?

GHSA-6q8v-2hvm-fx37 affects 2 products, including: maven/org.apache.tika:tika:\u003c 1.28.4; maven/org.apache.tika:tika:\u003e= 2.0.0, \u003c 2.4.1.

GHSA-6q8v-2hvm-fx37LowCVSS 3.3

Apache Tika contains incomplete fix for regex DoS

Vendor

GitHub Security Advisories

Published

June 28, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-33879 →

📋 Description

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.

🎯 Affected products2

maven/org.apache.tika:tika:< 1.28.4
maven/org.apache.tika:tika:>= 2.0.0, < 2.4.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-33879
https://lists.apache.org/thread/wfno8mf5nlcvbs78z93q9thgrm30wwfh
http://www.openwall.com/lists/oss-security/2022/06/27/5
https://security.netapp.com/advisory/ntap-20220812-0004/
https://github.com/advisories/GHSA-6q8v-2hvm-fx37