CVE-2022-33879: Apache Tika contains incomplete fix for regex DoS

June 28, 2022 (updated August 15, 2022)

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.

References

www.openwall.com/lists/oss-security/2022/06/27/5
github.com/advisories/GHSA-6q8v-2hvm-fx37
lists.apache.org/thread/wfno8mf5nlcvbs78z93q9thgrm30wwfh
nvd.nist.gov/vuln/detail/CVE-2022-33879
security.netapp.com/advisory/ntap-20220812-0004/

Code Behaviors & Features

Detect and mitigate CVE-2022-33879 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →