Home > Vulnerability Database > CVE-2018-17197

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2018-17197

Good to know:

Date: December 24, 2018

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.

Language: Java

Severity Score

4.3

Related Resources (7)

Url: https://www.oracle.com/security-alerts/cpuapr2020.html

Url: https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2018-17197

Url: https://lists.apache.org/thread.html/7c021a4ea2037e52e74628e17e8e0e2acab1f447160edc8be0eae6d3%40%3Cdev.tika.apache.org%3E

Url: http://www.securityfocus.com/bid/106293

Url: https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E

Url: https://www.mend.io/vulnerability-database/CVE-2018-17197

Severity Score

4.3

Weakness Type (CWE)

Uncontrolled Resource Consumption ('Resource Exhaustion')

CWE-400

Loop with Unreachable Exit Condition ('Infinite Loop')

CWE-835

Top Fix

Upgrade Version

Upgrade to version org.apache.tika:tika-parsers:1.20,org.apache.tika:tika-core:1.20

CVSS v3

Base Score:	4.3
Attack Vector (AV):
Attack Complexity (AC):
Privileges Required (PR):
User Interaction (UI):
Scope (S):
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL

CVSS v2

Base Score:	7.8
Access Vector (AV):
Access Complexity (AC):
Authentication (AU):
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH
Additional information:

Do you need more information?

Contact Us