CVE-2025-66516
tika-core: tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Red Hat. Niedriger laut Ubuntu (mittel).
Beschreibung
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tika:tika-core, org.apache.tika:tika-parser-pdf-module, org.apache.tika:tika-parsers | 3.2.2 und 1 weitere |
| chainguard | solr-9, solr-fips-9 | 0 |
| debian 11 | tika | 1.22-2+deb11u1 |
| minimos | apache-tika-3.0, apache-tika-3.1, elasticsearch-8 und 3 weitere | 3.0.0-r5 und 5 weitere |
| seal maven::Seal Security Database | org.apache.tika:tika-parsers, seal.sp1p1.org.apache.tika:tika-parsers | 1.28.5+sp2p2 und 1 weitere |
| ubuntu 18.04-ESM | tika | kein Fix angegeben |
| ubuntu 20.04-ESM | tika | 1.22-1ubuntu0.1~esm2 |
| ubuntu 22.04 | tika | 1.22-2+deb11u1build0.22.04.1 |
| ubuntu 24.04 | tika | kein Fix angegeben |
| ubuntu 26.04 | tika | kein Fix angegeben |
| ubuntu 26.10 | tika | kein Fix angegeben |
Alle 20 Einträge aus 11 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tika:tika-core | 3.2.2 |
| maven::GitHub Security Advisory Maven | org.apache.tika:tika-parser-pdf-module | 3.2.2 |
| maven::GitHub Security Advisory Maven | org.apache.tika:tika-parsers | 2.0.0 |
| chainguard | solr-9 | 0 |
| chainguard | solr-fips-9 | 0 |
| debian 11 | tika | 1.22-2+deb11u1 |
| minimos | apache-tika-3.0 | 3.0.0-r5 |
| minimos | apache-tika-3.1 | 3.1.0-r5 |
| minimos | elasticsearch-8 | 8.19.3-r0 |
| minimos | elasticsearch-9.1 | 9.1.4-r0 |
| minimos | opensearch-2 | 2.19.4-r0 |
| minimos | opensearch-3 | 3.3.0-r0 |
| seal maven::Seal Security Database | org.apache.tika:tika-parsers | 1.28.5+sp2p2 |
| seal maven::Seal Security Database | seal.sp1p1.org.apache.tika:tika-parsers | 1.28.5+sp999 |
| ubuntu 18.04-ESM | tika | kein Fix angegeben |
| ubuntu 20.04-ESM | tika | 1.22-1ubuntu0.1~esm2 |
| ubuntu 22.04 | tika | 1.22-2+deb11u1build0.22.04.1 |
| ubuntu 24.04 | tika | kein Fix angegeben |
| ubuntu 26.04 | tika | kein Fix angegeben |
| ubuntu 26.10 | tika | kein Fix angegeben |
Referenzen
- https://access.redhat.com/security/cve/CVE-2025-66516
- https://cve.org/CVERecord?id=CVE-2025-54988
- https://github.com/apache/tika
- https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k
- https://nvd.nist.gov/vuln/detail/CVE-2025-66516
- https://ubuntu.com/security/notices/USN-8324-1
- https://www.cve.org/CVERecord?id=CVE-2025-66516