[
https://issues.apache.org/jira/browse/TIKA-2952?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17021114#comment-17021114
]
Tim Allison edited comment on TIKA-2952 at 1/22/20 2:50 PM:
------------------------------------------------------------
Thank you for the note. This gets us one step further. The problem I
mentioned above, tho, is that metadata extractor relies on a newer version of
adobe xmp that has changed its name space to *.internal.* which will be
backwards incompatible with our tika-xmp module. With this release, I can at
least test forking it and maven-shade-relocating.
was (Author: [email protected]):
Thank you for the note. This gets us one step further. The problem I
mentioned above, tho, is that metadata extractor has changed the adobe xmp name
space to *.internal.* which will be backwards incompatible with our xmp
library. With this release, I can at least test forking it and
maven-shade-relocating.
> Vulnerable "metadata-extractor 2.11.0" is present in tika 1.22.
> ---------------------------------------------------------------
>
> Key: TIKA-2952
> URL: https://issues.apache.org/jira/browse/TIKA-2952
> Project: Tika
> Issue Type: Bug
> Reporter: Aman Mishra
> Priority: Major
>
> We can see that metadata-extractor with version 2.11.0 is present in
> tika-bundle 1.22 jar. We can see that even latest metadata-extractor with
> version 2.12.0 is also vulnerable.
>
> So please confirm your side that "Is this vulnerability [CVE-2019-14262] is
> impacting to tika or not ?"
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
