CVE-2022-25169

moderate-risk
Published 2022-05-16

The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.

Do I need to act?

-
0.31% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (6)

Affected Vendors

Apache Oracle

References (8)

Mailing List http://www.openwall.com/lists/oss-security/2022/05/16/4
Mailing List https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk
Third Party Advisory https://security.netapp.com/advisory/ntap-20220804-0004/
Third Party Advisory https://www.oracle.com/security-alerts/cpujul2022.html
Mailing List http://www.openwall.com/lists/oss-security/2022/05/16/4
Mailing List https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk
Third Party Advisory https://security.netapp.com/advisory/ntap-20220804-0004/
Third Party Advisory https://www.oracle.com/security-alerts/cpujul2022.html
32
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 13/34 · Low