CVE-2018-11796: XEE
Apache Tika 1.19 included an incomplete fix for CVE-2018-11761 which added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika 1.19 is therefore still vulnerable to entity expansions which can lead to a denial of service attack.
External Reference:
https://lists.apache.org/thread.html/88de8350cda9b184888ec294c813c5bd8a2081de8fd3666f8904bc05@%3Cdev.tika.apache.org%3E
Upstream Issue:
https://issues.apache.org/jira/projects/TIKA/issues/TIKA-2727
Upstream Patch:
https://github.com/apache/tika/commit/86d4ba1e
Other sources
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-11796?
CVE-2018-11796 is a vulnerability in Apache Tika 1.19 (CVE-2018-11761) that allows XML entity expansion.
How does CVE-2018-11796 affect Apache Tika?
CVE-2018-11796 affects Apache Tika versions 1.19 up to, but not including, 1.19.1.
What is the severity of CVE-2018-11796?
CVE-2018-11796 has a severity value of 7.5, indicating a high severity.
How can I fix CVE-2018-11796?
To fix CVE-2018-11796, upgrade Apache Tika to version 1.19.1.
What is XML entity expansion?
XML entity expansion is a technique where entities in an XML document are expanded to include additional information.