CVE-2022-30973: Inefficient Regular Expression Complexity

May 31, 2022 (updated October 27, 2022)

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.

References

www.openwall.com/lists/oss-security/2022/05/31/2
lists.apache.org/thread/gqvb5t4p7tmdpl0y5bdbf72pgxj04h7p
nvd.nist.gov/vuln/detail/CVE-2022-30973

Code Behaviors & Features

Detect and mitigate CVE-2022-30973 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →