Main Vulnerability Database Vulnerabilities #VU37155

Infinite loop in Apache Tika - CVE-2018-1339

Published: April 25, 2018 / Updated: August 8, 2020

Vulnerability identifier: #VU37155

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1339

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.

Apache Tika
Fuse

Install update from vendor's website.

Apache Tika - update to 1.18
Fuse - update to 7.1.0