Main Vulnerability Database Vulnerabilities #VU37154

Infinite loop in Apache Tika - CVE-2018-1338

Published: April 25, 2018 / Updated: August 8, 2020

Vulnerability identifier: #VU37154

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1338

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

Apache Tika
Fuse

Install update from vendor's website.

Apache Tika - update to 1.18
Fuse - update to 7.1.0