Bug 2063292 (CVE-2022-26336)

Summary:	CVE-2022-26336 poi-scratchpad: A carefully crafted TNEF file can cause an out of memory exception
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aileenc, asoldano, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, dkreling, dosoudil, drieden, ewolinet, fjuma, gmalinko, gsmet, hamadhan, hbraun, iweiss, janstey, jcantril, jnethert, jochrist, jolee, jschatte, jstastny, jwon, krathod, lgao, lthon, mosmerov, msochure, msvehla, mszynkie, nwallace, pantinor, pdelbell, peholase, pgallagh, pjindal, pmackay, probinso, rruss, rstancel, rsvoboda, sbiarozk, sdouglas, smaestri, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-07-07 19:39:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2063293

Description Patrick Del Bello 2022-03-11 17:52:33 UTC

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

https://lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j
https://nvd.nist.gov/vuln/detail/CVE-2022-26336

Comment 7 errata-xmlrpc 2022-07-07 14:22:36 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532

Comment 8 Product Security DevOps Team 2022-07-07 19:38:57 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-26336