Bug 1632462 (CVE-2018-11761)

Summary:	CVE-2018-11761 tika: XML entity expansion vulnerability due to lack of limit configuration
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abergmann, aileenc, alazarot, anstephe, bkearney, cbuissar, chazlett, drieden, etirelli, gvarsami, hhorak, ibek, java-sig-commits, jcoleman, jolee, jorton, jschatte, jstastny, kconner, krathod, kverlaen, ldimaggi, lef, meissner, nwallace, paradhya, puntogil, rrajasek, rsynek, rwagner, rzhang, sdaley, tcunning, tkirby, tlestach, vhalbert
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	tika 1.19	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-12-10 01:24:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1632463, 1636026
Bug Blocks:	1632464

Description Pedro Sampaio 2018-09-24 20:40:19 UTC

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.

References:

https://lists.apache.org/thread.html/5553e10bba5604117967466618f219c0cae710075819c70cfb3fb421@%3Cdev.tika.apache.org%3E

Comment 1 Pedro Sampaio 2018-09-24 20:40:40 UTC

Created tika tracking bugs for this issue:

Affects: fedora-all [bug 1632463]

Comment 2 Tomas Hoger 2018-10-04 07:37:42 UTC

Upstream commit:

https://github.com/apache/tika/commit/bd9d75d8b0a85af2937047bfad04288c3044b2a6

Note that this commit would only apply cleanly to version 1.17 and later, which added XMLReaderUtils as part of the refactoring of XML parsers:

https://github.com/apache/tika/commit/c0c2eafe46224e5c316f2dede395308930a5ec0d

A fix for older versions would likely have to set entityExpansionLimit in all places XML parsers are created.

Comment 6 Cedric Buissart 2018-11-07 10:04:37 UTC

Statement:

This issue affects the versions of tika which is embedded in the nutch package  as shipped with Red Hat Satellite 5. The tika server is not exposed, as such exploitation is difficult, Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 10 Product Security DevOps Team 2019-12-10 01:24:01 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-11761