CVE-2018-11796
published 2018-10-09CVE-2018-11796: In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse…
PriorityP341high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
6.88%
93.3th percentile
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tika | — | — |
| apache | tika | 0.1 – 1.19 | — |
| debian | tika | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_apache7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tika: Incomplete fix allows for XML entity expansion resulting in denial of service
vendor_redhat·2018-10-10·CVSS 7.5
CVE-2018-11796 [HIGH] CWE-776 tika: Incomplete fix allows for XML entity expansion resulting in denial of service
tika: Incomplete fix allows for XML entity expansion resulting in denial of service
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Statement: This issue affects the versions of tika which is embedded in the nutch package as shipped with Red Hat Satellite 5. The tika server is not exposed, as such exploitation is difficult, Red Hat Product Security
Debian
CVE-2018-11796: tika - In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML...
vendor_debian·2018·CVSS 7.5
CVE-2018-11796 [HIGH] CVE-2018-11796: tika - In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML...
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Scope: local
bullseye: resolved
sid: resolved
Apache
Apache tika: CVE-2018-11796
vendor_apache·CVSS 7.5
CVE-2018-11796 [HIGH] Apache tika: CVE-2018-11796
Apache tika: CVE-2018-11796
XML Entity Expansion in Tika's SAXParsers after reset() Slava Gorelik ?-1.19
OSV
Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
osv·2018-10-17·CVSS 7.5
CVE-2018-11796 [HIGH] Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
GHSA
Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
ghsa·2018-10-17·CVSS 7.5
CVE-2018-11796 [HIGH] CWE-611 Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
OSV
CVE-2018-11796: In Apache Tika 1
osv·2018-10-09·CVSS 7.5
CVE-2018-11796 [HIGH] CVE-2018-11796: In Apache Tika 1
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-11796 tika: Incomplete fix allows for XML entity expansion resulting in denial of service
bugzilla·2018-10-15·CVSS 7.5
CVE-2018-11796 [HIGH] CVE-2018-11796 tika: Incomplete fix allows for XML entity expansion resulting in denial of service
CVE-2018-11796 tika: Incomplete fix allows for XML entity expansion resulting in denial of service
Apache Tika 1.19 included an incomplete fix for CVE-2018-11761 which added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika 1.19 is therefore still vulnerable to entity expansions which can lead to a denial of service attack.
External Reference:
https://lists.apache.org/thread.html/88de8350cda9b184888ec294c813c5bd8a2081de8fd3666f8904bc05@%3Cdev.tika.apache.org%3E
Upstream Issue:
https://issues.apache.org/jira/projects/TIKA/issues/TIKA-2727
Upstream Patc
Bugzilla
CVE-2018-11796 tika: Incomplete fix allows for XML entity expansion resulting in denial of service [fedora-all]
bugzilla·2018-10-15·CVSS 7.5
CVE-2018-11796 [HIGH] CVE-2018-11796 tika: Incomplete fix allows for XML entity expansion resulting in denial of service [fedora-all]
CVE-2018-11796 tika: Incomplete fix allows for XML entity expansion resulting in denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue a
http://www.securityfocus.com/bid/105585https://access.redhat.com/errata/RHSA-2019:3892https://lists.apache.org/thread.html/88de8350cda9b184888ec294c813c5bd8a2081de8fd3666f8904bc05%40%3Cdev.tika.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20190903-0002/http://www.securityfocus.com/bid/105585https://access.redhat.com/errata/RHSA-2019:3892https://lists.apache.org/thread.html/88de8350cda9b184888ec294c813c5bd8a2081de8fd3666f8904bc05%40%3Cdev.tika.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20190903-0002/
2018-10-09
Published