CVE-2022-25169: The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files

Medium severity · published May 16, 2022

CVE-2022-25169

The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files

5.5

CVSS

2.2%

EPSS

On KEV

Description

The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.2% · higher than 82% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Primavera Unifier · Oracle

17.7 through 17.12; 18.8; 19.12; 20.12; 21.12 · source: NVD

Tika · Apache

before 1.28.2; 2.0.0 before 2.4.0 · source: NVD

Affected product

Tika

Apache

All Tika CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-25169

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-25169

Mailing List

http://www.openwall.com/lists/oss-security/2022/05/16/4

Mailing List

https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220804-0004/

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html