You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@tika.apache.org by Maik Weber <ma...@de.ibm.com> on 2025/12/10 11:14:54 UTC
Re: Tika 3.2.2 CVE scan report
Hi,
Our CVE scan reports the same CVE-2024-6763 issue for Apache Tika 3.2.3.
The versions of Eclipse Jetty 7.0.0 - 12.0.11 are known to be affected by CVE-2024-6763:
https://www.cve.org/CVERecord?id=CVE-2024-6763
As stated, Apache Tika 3.2.3 includes Jetty 11.0.26
Now, Eclipse Jetty 12.0.12 resolves the issue. The latest version of Eclipse Jetty is 12.0.31
So, to resolve this (and other) issues, the security-vulnerable version has to be replaced by the latest version.
When will the included version of Jetty be updated in Apache Tika?
Greetings
Maik
On 2025/11/26 11:51:35 Tilman Hausherr wrote:
> Hi,
>
> The current version is 3.2.3 and that one uses 11.0.26.
>
> Tilman
>
> Am 26.11.2025 um 12:46 schrieb Saravanan Balakrishnan:
> > Thanks for the mail. Is there plan to fix for CVE-2024-6763
> > jetty-http-11.0.25.jar file used in the Tika 3.2.2,
> > https://nvd.nist.gov/vuln/detail/cve-2024-6763
> > Regards,
> > Saravanan B
Re: Tika 3.2.2 CVE scan report
Posted by Tilman Hausherr <TH...@t-online.de>.
And one more important things: tika doesn't use jetty-server directly.
tika-pipes-opensearch and tika-grp uses it for build testing. Tika
server uses it indirectly because cxf-rt-transports-http-jetty uses it.
Tilman
Am 10.12.2025 um 17:26 schrieb Tilman Hausherr:
> I assume the text below was for the mailing list; thanks for the
> clarification.
> I retried building with a jetty 12 version and failed again, and have
> updated my comment in the trunk pom.xml file.
>
> Re the CVE link below - "The impact of this vulnerability is limited
> to developers that use the Jetty HttpURI directly." we don't use this.
> We use "HttpUriRequest" but only in a build test. This would mean
> we're not affected.
>
> Tilman
>
> Am 10.12.2025 um 16:58 schrieb Maik Weber:
>> Many thanks for your efforts!
>>
>> Seems that the information at NIST is out-dated.
>>
>> The Jetty project reports the CVE for org.eclipse.jetty:jetty-http :
>> >=7.0.0, <=12.0.11
>> https://gitlab.eclipse.org/security/cve-assignment/-/issues/25
>>
>> Maik
>>
>> -----Original Message-----
>> *From*: Tilman Hausherr <THausherr@t-online.de
>> <mailto:Tilman%20Hausherr%20%3cTHausherr@t-online.de%3e>>
>> *Reply-To*: user@tika.apache.org
>> *To*: user@tika.apache.org
>> *Subject*: [EXTERNAL] Re: Tika 3.2.2 CVE scan report
>> *Date*: 12/10/2025 01:53:36 PM
>> Hi,
>>
>> According to https://nvd.nist.gov/vuln/detail/cve-2024-6763
>>
>> jetty is vulnerable up to 9.4.57
>>
>> We can't update to jetty 12 because of troubles with solrj. I could
>> make another attempt because it's now another solr version.
>>
>> Tilman
>
>
Re: Tika 3.2.2 CVE scan report
Posted by Tilman Hausherr <TH...@t-online.de>.
I assume the text below was for the mailing list; thanks for the
clarification.
I retried building with a jetty 12 version and failed again, and have
updated my comment in the trunk pom.xml file.
Re the CVE link below - "The impact of this vulnerability is limited to
developers that use the Jetty HttpURI directly." we don't use this. We
use "HttpUriRequest" but only in a build test. This would mean we're not
affected.
Tilman
Am 10.12.2025 um 16:58 schrieb Maik Weber:
> Many thanks for your efforts!
>
> Seems that the information at NIST is out-dated.
>
> The Jetty project reports the CVE for org.eclipse.jetty:jetty-http :
> >=7.0.0, <=12.0.11
> https://gitlab.eclipse.org/security/cve-assignment/-/issues/25
>
> Maik
>
> -----Original Message-----
> *From*: Tilman Hausherr <THausherr@t-online.de
> <mailto:Tilman%20Hausherr%20%3cTHausherr@t-online.de%3e>>
> *Reply-To*: user@tika.apache.org
> *To*: user@tika.apache.org
> *Subject*: [EXTERNAL] Re: Tika 3.2.2 CVE scan report
> *Date*: 12/10/2025 01:53:36 PM
> Hi,
>
> According to https://nvd.nist.gov/vuln/detail/cve-2024-6763
>
> jetty is vulnerable up to 9.4.57
>
> We can't update to jetty 12 because of troubles with solrj. I could
> make another attempt because it's now another solr version.
>
> Tilman
Re: Tika 3.2.2 CVE scan report
Posted by Tilman Hausherr <TH...@t-online.de>.
Hi,
According to https://nvd.nist.gov/vuln/detail/cve-2024-6763
jetty is vulnerable up to 9.4.57
We can't update to jetty 12 because of troubles with solrj. I could make
another attempt because it's now another solr version.
Tilman
Am 10.12.2025 um 12:14 schrieb Maik Weber:
> Hi,
>
> Our CVE scan reports the same CVE-2024-6763 issue for Apache Tika 3.2.3.
>
> The versions of Eclipse Jetty 7.0.0 - 12.0.11 are known to be affected
> by CVE-2024-6763:
> https://www.cve.org/CVERecord?id=CVE-2024-6763
>
> As stated, Apache Tika 3.2.3 includes Jetty 11.0.26
>
> Now, Eclipse Jetty 12.0.12 resolves the issue. The latest version of
> Eclipse Jetty is 12.0.31
>
> So, to resolve this (and other) issues, the security-vulnerable
> version has to be replaced by the latest version.
> When will the included version of Jetty be updated in Apache Tika?
>
> Greetings
> Maik
>
>
> On 2025/11/26 11:51:35 Tilman Hausherr wrote:
> > Hi,
> >
> > The current version is 3.2.3 and that one uses 11.0.26.
> >
> > Tilman
> >
> > Am 26.11.2025 um 12:46 schrieb Saravanan Balakrishnan:
> > > Thanks for the mail. Is there plan to fix for CVE-2024-6763
> > > jetty-http-11.0.25.jar file used in the Tika 3.2.2,
> > > https://nvd.nist.gov/vuln/detail/cve-2024-6763
> > > Regards,
> > > Saravanan B