You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@tika.apache.org by "Shubhangi Raut (Jira)" <ji...@apache.org> on 2021/11/24 23:00:00 UTC

[jira] [Created] (TIKA-3600) Upgrade gson version in tika-app

Shubhangi Raut created TIKA-3600:
------------------------------------

             Summary: Upgrade gson version in tika-app
                 Key: TIKA-3600
                 URL: https://issues.apache.org/jira/browse/TIKA-3600
             Project: Tika
          Issue Type: Bug
    Affects Versions: 1.27
            Reporter: Shubhangi Raut
             Fix For: 1.27.1


The gson package from tika-app is vulnerable due to Deserialization of Untrusted Data. The serializable LazilyParsedNumber, LinkedHashTreeMap, and LinkedTreeMap classes permit unsafe deserialization due to use of the default Serializable.readObject[] implementation.

CVE : sonatype-2021-1694
URL : [https://vw-pun-bpm-bl15.bmc.com:8070/ui/links/vln/sonatype-2021-1694] 

gson-2.8.9 is non-vulnerable version. Please consider upgrading to it in the next release.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)