{"id":"CVE-2022-33879","published":"2022-06-27T21:40:10Z","modified":"2024-08-03T08:09:22Z","title":"Incomplete fix and new regex DoS in StandardsExtractingContentHandler","vendor":"Apache","product":"Apache Tika","tier":"tail","description":{"text":"The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02032,"percentile":0.80986,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread/wfno8mf5nlcvbs78z93q9thgrm30wwfh","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2022/06/27/5","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.netapp.com/advisory/ntap-20220812-0004/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.2,"factors":[{"name":"EPSS percentile","points":16.2}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tika","versions":[">= Apache Tika, < 2.4.1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tika:tika","vulnerableRanges":["<1.28.4",">=2.0.0, <2.4.1"],"patched":["1.28.4","2.4.1"],"from":["GHSA-6q8v-2hvm-fx37"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5964","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tika-cve-2022-30126","parents":[{"from":"CVE-2022-30126","to":"CVE-2022-33879","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler.","from":"CVE.org","in":"CVE-2022-33879"},{"kind":"similar","provenance":"machine","score":0.48,"basis":"same product + description similarity"}]},{"from":"CVE-2022-30973","to":"CVE-2022-33879","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler.","from":"CVE.org","in":"CVE-2022-33879"},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same product + description similarity"}]}],"packageHistory":[{"cve":"CVE-2020-9489","published":"2020-04-27","fixed":"1.24.1","kev":false},{"cve":"CVE-2021-28657","published":"2021-03-31","fixed":"1.26","kev":false},{"cve":"CVE-2022-25169","published":"2022-05-16","fixed":"2.4.0","kev":false,"link":{"from":"CVE-2022-25169","to":"CVE-2022-33879","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tika:tika","fromFixed":"1.28.2","toFixed":"1.28.4","daysApart":42},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tika:tika","fromFixed":"2.4.0","toFixed":"2.4.1","daysApart":42}]}},{"cve":"CVE-2022-33879","published":"2022-06-27","fixed":"2.4.1","kev":false}],"package":"Maven:org.apache.tika:tika"}}