Bug 1111309 – VUL-1: CVE-2018-11796: tika-core: Denial of Service via XML Entity Expansion Vulnerability

Bug 1111309 - (CVE-2018-11796) VUL-1: CVE-2018-11796: tika-core: Denial of Service via XML Entity Expansion Vulnerability

(CVE-2018-11796)
Summary:	VUL-1: CVE-2018-11796: tika-core: Denial of Service via XML Entity Expansion ...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/216367/
Whiteboard:	CVSSv3:SUSE:CVE-2018-11796:6.2:(AV:L/...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2018-10-10 06:24 UTC by Johannes Segitz
Modified:	2020-07-13 15:14 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Johannes Segitz 2018-10-10 06:24:35 UTC

CVE-2018-11796: Apache Tika Denial of Service via XML Entity Expansion
Vulnerability

Severity: Medium

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Tika 0.1 to 1.19

Description:
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion
limit for XML parsing.  However, Tika reuses SAXParsers and calls
reset() after each parse, which, for Xerces2 parsers, as per the
documentation, removes the user-specified SecurityManager and
thus removes entity expansion limits after the first parse.
Apache Tika 1.19 is therefore still vulnerable to entity
expansions which can lead to a denial of service attack.

Mitigation:
Apache Tika users should upgrade to 1.19.1 or later

Credit:
This issue was discovered by Slava Gorelik of CloudAlly.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11796
http://seclists.org/oss-sec/2018/q4/31

Comment 1 Joao Cavalheiro 2018-10-12 16:17:59 UTC

Apache Tika 1.19.1 packaged and submitted to SUSE Manager 3.1, 3.2 and Uyuni.
Will be part of next releases.

Comment 2 Alexander Bergmann 2018-10-15 06:25:15 UTC

Upstream issue:
https://issues.apache.org/jira/projects/TIKA/issues/TIKA-2727

Upstream patch:
https://github.com/apache/tika/commit/86d4ba1e

Comment 3 Alexandros Toptsoglou 2020-07-13 15:14:48 UTC

tika-core in SUSE manager is not affected since its version ships already the fix