CVE-2018-8017 Comparison errorr in org.apache.tika:tika-core
MediumCVSS 5.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tika/tika-core(Maven) | >= 1.2, < 1.19 | 1.19 |
| org.apache.tika/tika-core(Maven) | = 1.10 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.11 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.12 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.13 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.14 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.15 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.16 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.17 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.18 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.2 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.3 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.4 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.5 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.6 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.7 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.8 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.9 | No fix listed |
| debian/tika(Debian:11) | < 1.20-1 | 1.20-1 |
| apache tika | >= 1.2, <= 1.18 | No fix listed |
| ubuntu/tika(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/tika(Ubuntu:26.10) | All versions | No fix listed |
| Apache Tika | = 1.2 to 1.18 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com vendor-advisory
- github.com product
- lists.apache.org
- 105513 third-party-advisory vdb-entry
- security-tracker.debian.org vendor-advisory
- [tika-dev] 20180919 [CVE-2018-8017] Apache Tika Denial of Service Vulnerability -- Potential Infinite Loop in IptcAnpaParser mailing-list
- Ubuntu CVE tracker vendor-advisory
- www.cve.org