CVE-2022-25169
published 2022-05-16CVE-2022-25169: The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
PriorityP423medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
2.05%
79.1th percentile
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tika | < 1.28.2 | 1.28.2 |
| apache | tika | — | — |
| apache | tika | >= 2.0.0 < 2.4.0 | 2.4.0 |
| apache_software_foundation | apache_tika | Apache Tika – 1.28.1 | — |
| debian | tika | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | 17.7 – 17.12 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_apache5.5MEDIUM
vendor_debian5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2022-25169: tika - The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate a...
vendor_debian·2022·CVSS 5.5
CVE-2022-25169 [MEDIUM] CVE-2022-25169: tika - The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate a...
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
Scope: local
bullseye: open
sid: open
Apache
Apache tika: CVE-2022-25169
vendor_apache·CVSS 5.5
CVE-2022-25169 [MEDIUM] Apache tika: CVE-2022-25169
Apache tika: CVE-2022-25169
BPGParser Memory Usage DoS ??? ???-2.3.0 and ???-1.28.1
GHSA
Apache Tika vulnerable to uncontrolled memory consumption
ghsa·2022-05-17
CVE-2022-25169 [MEDIUM] CWE-400 Apache Tika vulnerable to uncontrolled memory consumption
Apache Tika vulnerable to uncontrolled memory consumption
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
OSV
Apache Tika vulnerable to uncontrolled memory consumption
osv·2022-05-17
CVE-2022-25169 [MEDIUM] Apache Tika vulnerable to uncontrolled memory consumption
Apache Tika vulnerable to uncontrolled memory consumption
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
OSV
CVE-2022-25169: The BPG parser in versions of Apache Tika before 1
osv·2022-05-16·CVSS 5.5
CVE-2022-25169 [MEDIUM] CVE-2022-25169: The BPG parser in versions of Apache Tika before 1
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2022/05/16/4https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rkhttps://security.netapp.com/advisory/ntap-20220804-0004/https://www.oracle.com/security-alerts/cpujul2022.htmlhttp://www.openwall.com/lists/oss-security/2022/05/16/4https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rkhttps://security.netapp.com/advisory/ntap-20220804-0004/https://www.oracle.com/security-alerts/cpujul2022.html
2022-05-16
Published