[jira] [Comment Edited] (TIKA-3729) CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially crafted JPEG file

["Tim Allison (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TIKA-3729?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17526604#comment-17526604 ] 

Tim Allison edited comment on TIKA-3729 at 4/22/22 5:53 PM:
------------------------------------------------------------

Thank you for raising this.  We're already on 2.17.0 in 2.x.  And, we plan to start the release process for that in the next few weeks.

On 1.x, we're stuck with an older fork of drewnoakes' metadata extractor because of some namespace issues with xmp-core.


was (Author: tallison@mitre.org):
Thank you for raising this.  We're already on 2.17.0 in the dev branches for 1.x and 2.x.  We're kicking off the release processes for both in the next two weeks.

> CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially crafted JPEG file
> -------------------------------------------------------------------------------------------
>
>                 Key: TIKA-3729
>                 URL: https://issues.apache.org/jira/browse/TIKA-3729
>             Project: Tika
>          Issue Type: Bug
>          Components: metadata
>    Affects Versions: 1.28.1, 2.3.0
>            Reporter: Luigi De Masi
>            Priority: Major
>             Fix For: 2.3.0
>
>
> CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially crafted JPEG file
> When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.
>  
> https://github.com/drewnoakes/metadata-extractor/issues/561



--
This message was sent by Atlassian Jira
(v8.20.7#820007)