search

eXist-db / exist

eXist Native XML Database and Application Platform
https://exist-db.org
GNU Lesser General Public License v2.1
423 stars 179 forks source link

Upgrade Tika to 1.13 #1026

Closed joewiz closed 7 years ago

joewiz commented 8 years ago

From the tika-user list:

CVE-2016-4434: Apache Tika XML External Entity vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache Tika 0.10 to 1.12

Description: Apache Tika parses XML within numerous file formats. In some instances[1], the initialization ofthe XML parser or the choice of handlers did not protect against XML External Entity (XXE) vulnerabilities. According to www.owasp.org [2]: "This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts."

Mitigation: Upgrade to Apache Tika 1.13.

Credit: This issue was discovered by Arthur Khashaev (https://khashaev.ru), Seulgi Kim, Mesut Timur,and Microsoft Vulnerability Research.

[1] Spreadsheets in OOXML files and XMP in PDF and other file formats. [2] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

joewiz commented 8 years ago

eXist uses 1.12:

https://github.com/eXist-db/exist/blob/503ad3283e7f1cb7049b05eb3c5ed3d5d9a8b891/extensions/contentextraction/ivy.xml#L11

dizzzz commented 8 years ago

Ok, I know what I should do :)

dizzzz commented 8 years ago

should we invest time to make this a separate XAR file?

joewiz commented 7 years ago

Superseded by https://github.com/eXist-db/exist/issues/1179.