CVE-2022-30973

Missing fix for CVE-2022-30126 in 1.28.2

Description

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.

Remediation

Workaround:

Avoid using the StandardsExtractingContentHandler or upgrade to Tika 1.28.3 or 2.4.0

5.5

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.15%

Vendor Advisory apache.org

Affected: Apache Software Foundation Apache Tika

References

Link	Tags
https://lists.apache.org/thread/gqvb5t4p7tmdpl0y5bdbf72pgxj04h7p	vendor advisory mailing list
http://www.openwall.com/lists/oss-security/2022/05/31/2	third party advisory mailing list
http://www.openwall.com/lists/oss-security/2022/06/27/5	third party advisory mailing list
https://security.netapp.com/advisory/ntap-20220722-0004/	third party advisory

Frequently Asked Questions

What is the severity of CVE-2022-30973?: CVE-2022-30973 has been scored as a medium severity vulnerability.
How to fix CVE-2022-30973?: As a workaround for remediating CVE-2022-30973: Avoid using the StandardsExtractingContentHandler or upgrade to Tika 1.28.3 or 2.4.0
Is CVE-2022-30973 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-30973 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-30973?: CVE-2022-30973 affects Apache Software Foundation Apache Tika.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.