CVE-2018-11761: XEE
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/tikato a version that resolves this vulnerability.Fixed in 1.19 - Configuration
Configure the XML parsers to limit entity expansion to prevent denial-of-service attacks.
Apache Tika XML parsers entity expansion = limited
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-11761.
What is the severity of CVE-2018-11761?
The severity of CVE-2018-11761 is high with a score of 7.5.
What is the impact of CVE-2018-11761?
CVE-2018-11761 can lead to a denial of service attack.
Which software versions are affected by CVE-2018-11761?
Apache Tika versions from 0.1 to 1.18 and Oracle Business Process Management Suite versions 12.1.3.0.0 and 12.2.1.3.0 are affected by CVE-2018-11761.
How can I mitigate the vulnerability CVE-2018-11761?
The vulnerability CVE-2018-11761 can be mitigated by upgrading to Apache Tika version 1.19.