Bug 22954 - tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197, CVE-2019-10088, CVE-2019-10094, CVE-2020-195[01], CVE-2021-28657
Summary: tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12],...
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: Java Stack Maintainers
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
: 28082 (view as bug list)
Depends on:
Blocks: 18557
  Show dependency tree / graph
 
Reported: 2018-04-26 13:53 CEST by David Walser
Modified: 2021-07-01 18:15 CEST (History)
2 users (show)

See Also:
Source RPM: tika-1.17-1.mga7.src.rpm
CVE:
Status comment: Fixed upstream in 1.26

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2018-04-26 13:53:16 CEST 
Upstream has issued advisories on April 25:
http://openwall.com/lists/oss-security/2018/04/25/6
http://openwall.com/lists/oss-security/2018/04/25/7
http://openwall.com/lists/oss-security/2018/04/25/8

The issues are fixed upstream in 1.18.

Mageia 5 and Mageia 6 are also affected.
David Walser 2018-04-26 13:53:27 CEST

Whiteboard: (none) => MGA6TOO

David Walser 2018-05-04 08:27:05 CEST

Status comment: (none) => Fixed upstream in 1.18

Comment 1 David Walser 2018-09-19 23:20:11 CEST 
Upstream has issued advisories today (September 19):
https://www.openwall.com/lists/oss-security/2018/09/19/4
https://www.openwall.com/lists/oss-security/2018/09/19/5
https://www.openwall.com/lists/oss-security/2018/09/19/6

The issues are fixed upstream in 1.19.

Summary: tika new security issues CVE-2018-133[589] => tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12]
Status comment: Fixed upstream in 1.18 => Fixed upstream in 1.19
Blocks: (none) => 18557

Comment 2 David Walser 2018-10-10 16:34:33 CEST 
Upstream has issued an advisory on October 9:
https://www.openwall.com/lists/oss-security/2018/10/09/7

The issue is fixed upstream in 1.19.1.

Summary: tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12] => tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796
Status comment: Fixed upstream in 1.19 => Fixed upstream in 1.19.1

Comment 3 David Walser 2018-12-23 00:20:21 CET 
Upstream has issued an advisory today (December 22):
https://www.openwall.com/lists/oss-security/2018/12/22/2

The issue is fixed upstream in 1.20.

Source RPM: tika-1.12-1.mga6.src.rpm => tika-1.17-1.mga7.src.rpm
Status comment: Fixed upstream in 1.19.1 => Fixed upstream in 1.20
Summary: tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796 => tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197

David Walser 2019-06-23 19:29:59 CEST

Whiteboard: MGA6TOO => MGA7TOO, MGA6TOO

Comment 4 David Walser 2019-08-06 12:51:59 CEST 
Upstream has issued advisories on August 2:
https://www.openwall.com/lists/oss-security/2019/08/02/2
https://www.openwall.com/lists/oss-security/2019/08/02/4

The issues are fixed upstream in 1.22.

Status comment: Fixed upstream in 1.20 => Fixed upstream in 1.22
Summary: tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197 => tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197, CVE-2019-10088, CVE-2019-10094

Comment 5 David Walser 2020-03-18 23:26:22 CET 
Upstream has issued advisories today (March 18):
https://www.openwall.com/lists/oss-security/2020/03/18/3
https://www.openwall.com/lists/oss-security/2020/03/18/4

The issues are fixed upstream in 1.24.

Status comment: Fixed upstream in 1.22 => Fixed upstream in 1.24

Comment 6 David Walser 2020-03-31 22:31:12 CEST 
(In reply to David Walser from comment #5)
> Upstream has issued advisories today (March 18):
> https://www.openwall.com/lists/oss-security/2020/03/18/3
> https://www.openwall.com/lists/oss-security/2020/03/18/4
> 
> The issues are fixed upstream in 1.24.

Debian-LTS has issued an advisory for this on March 28:
https://www.debian.org/lts/security/2020/dla-2161

Summary: tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197, CVE-2019-10088, CVE-2019-10094 => tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197, CVE-2019-195[01], CVE-2019-10088, CVE-2019-10094

Nicolas Lécureuil 2020-05-22 14:06:51 CEST

CC: (none) => mageia
Whiteboard: MGA7TOO, MGA6TOO => MGA7TOO

Comment 7 David Walser 2020-10-13 18:35:14 CEST 
Ubuntu has issued an advisory for this on October 5:
https://ubuntu.com/security/notices/USN-4564-1

Summary: tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197, CVE-2019-195[01], CVE-2019-10088, CVE-2019-10094 => tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197, CVE-2019-10088, CVE-2019-10094, CVE-2020-195[01]

Comment 8 Nicolas Lécureuil 2020-12-26 23:25:26 CET 
not in cauldron anymore

Whiteboard: MGA7TOO => (none)
Version: Cauldron => 7

Comment 9 David Walser 2021-01-13 17:46:52 CET 
*** Bug 28082 has been marked as a duplicate of this bug. ***

CC: (none) => zombie_ryushu

Comment 10 David Walser 2021-03-30 23:34:41 CEST 
Apache has issued an advisory today (March 30):
https://www.openwall.com/lists/oss-security/2021/03/30/3

The issue is fixed upstream in 1.26.

Summary: tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197, CVE-2019-10088, CVE-2019-10094, CVE-2020-195[01] => tika new security issues CVE-2018-133[589], CVE-2018-8017, CVE-2018-1176[12], CVE-2018-11796, CVE-2018-17197, CVE-2019-10088, CVE-2019-10094, CVE-2020-195[01], CVE-2021-28657
Status comment: Fixed upstream in 1.24 => Fixed upstream in 1.26

Comment 11 David Walser 2021-07-01 18:15:42 CEST 
https://blog.mageia.org/en/2021/06/08/mageia-7-will-reach-end-of-support-on-30th-of-june-the-king-is-dead-long-live-the-king/

Resolution: (none) => OLD
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.