Resource exhaustion in Apache Tika - CVE-2022-25169

Vulnerability identifier: #VU63405

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-25169

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in BPG parser. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Apache Tika
Log Analysis
IBM Cloud Transformation Advisor
Content Collector for Email
Content Collector for Microsoft SharePoint
Content Collector for File Systems
Content Collector for IBM Connections
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
IBM Enterprise Content Management Text Search
IBM FileNet Content Manager

Install updates from vendor's website.

Apache Tika - addressed in versions 1.28.2, 2.4.0
Log Analysis - update to 1.3.7.2 IF001
Cloud Pak for Security (CP4S) - update to 1.10.7.0
IBM Cloud Transformation Advisor - update to 3.2.0
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 6, 7.5.0 Update Pack 3

• https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk
• http://www.openwall.com/lists/oss-security/2022/05/16/4

• Multiple vulnerabilities in Apache Tika
• Multiple Vulnerabilities in IBM Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM QRadar SIEM
• IBM Log Analysis update for Apache Tika
• IBM Enterprise Content Management Text Search update for Apache Tika
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)