[
https://issues.apache.org/jira/browse/TIKA-3729?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17526604#comment-17526604
]
Tim Allison edited comment on TIKA-3729 at 4/22/22 5:53 PM:
------------------------------------------------------------
Thank you for raising this. We're already on 2.17.0 in 2.x. And, we plan to
start the release process for that in the next few weeks.
On 1.x, we're stuck with an older fork of drewnoakes' metadata extractor
because of some namespace issues with xmp-core.
was (Author: [email protected]):
Thank you for raising this. We're already on 2.17.0 in the dev branches for
1.x and 2.x. We're kicking off the release processes for both in the next two
weeks.
> CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially
> crafted JPEG file
> -------------------------------------------------------------------------------------------
>
> Key: TIKA-3729
> URL: https://issues.apache.org/jira/browse/TIKA-3729
> Project: Tika
> Issue Type: Bug
> Components: metadata
> Affects Versions: 1.28.1, 2.3.0
> Reporter: Luigi De Masi
> Priority: Major
> Fix For: 2.3.0
>
>
> CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially
> crafted JPEG file
> When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0
> can be made to allocate large amounts of memory that finally leads to an
> out-of-memory error even for very small inputs. This could be used to mount a
> denial of service attack against services that use metadata-extractor library.
>
> https://github.com/drewnoakes/metadata-extractor/issues/561
--
This message was sent by Atlassian Jira
(v8.20.7#820007)
