Apache Tika CVE-2018-11761 XML External Entity Denial of Service Vulnerability

Bugtraq ID:	105514
Class:	Input Validation Error
CVE:	CVE-2018-11761
Remote:	Yes
Local:	No
Published:	Sep 19 2018 12:00AM
Updated:	Apr 18 2019 11:00AM
Credit:	Renfei (Brian) Wang of Amazon.
Vulnerable:	Redhat Software Collections for RHEL 0 Oracle Business Process Management Suite 12.2.1.2.0 Oracle Business Process Management Suite 12.1.3.0.0 Apache Tika 1.9 Apache Tika 1.7 Apache Tika 1.6 Apache Tika 1.2 Apache Tika 1.18 Apache Tika 1.17 Apache Tika 1.14 Apache Tika 1.13 Apache Tika 1.12 Apache Tika 1.11 Apache Tika 1.10 Apache Tika 0.1
Not Vulnerable:	Apache Tika 1.19

Apache Tika CVE-2018-11761 XML External Entity Denial of Service Vulnerability

Apache Tika is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause a denial of service condition.

Apache Tika 0.1 through 1.18 are vulnerable.

Apache Tika CVE-2018-11761 XML External Entity Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Tika CVE-2018-11761 XML External Entity Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Tika CVE-2018-11761 XML External Entity Denial of Service Vulnerability

References:

• Apache Homepage (Apache)
  
• Bug 1632462 - (CVE-2018-11761) CVE-2018-11761 tika: XML entity expansion vulner (Redhat)
  
• CVE-2018-11761 (Redhat)
  
• CVE-2018-11761: Apache Tika Denial of Service via XML Entity Expansion Vulnerabi (Apache)
  
• Oracle Critical Patch Update Advisory - April 2019 (Oracle)