PT-2019-4681

CVE-2019-10088

Published

2019-08-02

Updated

2020-08-24

Description by

CVSS 2.0

9.3

High

MetricsAV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Tika versions 1.7 through 1.21

Description The issue is related to a buffer overflow in memory operations, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information. A carefully crafted or corrupt zip file can cause an out-of-memory (OOM) condition in Apache Tika's RecursiveParserWrapper.

Recommendations For Apache Tika versions 1.7 through 1.21, upgrade to version 1.22 or later.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers

CVE-2019-10088

BDU:2020-01019