You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jmeter.apache.org by "villesaaristo (via GitHub)" <gi...@apache.org> on 2025/08/28 09:40:12 UTC
[I] Vulnerability CVE-2025-54988: upgrade tika-core-1.28.5 and tika-parsers-1.28.5 to 3.2.2 [jmeter]
villesaaristo opened a new issue, #6497:
URL: https://github.com/apache/jmeter/issues/6497
JMeter Version: 5.6.3
https://github.com/apache/jmeter/blob/91ed1279438cbc2553121c8ea1afded0605b38e5/src/dist/src/dist/expected_release_jars.csv#L130-L131
https://github.com/apache/jmeter/blob/91ed1279438cbc2553121c8ea1afded0605b38e5/src/bom-thirdparty/build.gradle.kts#L115-L116
https://nvd.nist.gov/vuln/detail/CVE-2025-54988
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jmeter.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Vulnerability CVE-2025-54988: upgrade tika-core-1.28.5 and tika-parsers-1.28.5 to 3.2.2 [jmeter]
Posted by "vlsi (via GitHub)" <gi...@apache.org>.
vlsi commented on issue #6497:
URL: https://github.com/apache/jmeter/issues/6497#issuecomment-3460730932
Nice catch.
I've filed an improvement to GitHub vulnerability database so it captures the issue: https://github.com/github/advisory-database/pull/6366, and I asked Apache Tika team to update the base CVE metadata as well (see https://lists.apache.org/thread/stn9oh7rfn9yv76n1srxr9w56oy04p72).
I wonder how did you figure out the CVE impacts JMeter assuming the CVE metadata is not right.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jmeter.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Vulnerability CVE-2025-54988: upgrade tika-core-1.28.5 and tika-parsers-1.28.5 to 3.2.2 [jmeter]
Posted by "mbourgon (via GitHub)" <gi...@apache.org>.
mbourgon commented on issue #6497:
URL: https://github.com/apache/jmeter/issues/6497#issuecomment-3468385817
A stupid question from somebody helping out our team with vulnerabilities - we just saw this, and our internal team is getting flagged for this. How exactly do/can we patch this? It's _really_ not apparent as an outsider. I assume I can't just replace the jar file? (This is on Windows Server). It appears that 5.6.3 is the most recent, so I'm at a loss. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jmeter.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Vulnerability CVE-2025-54988: upgrade tika-core-1.28.5 and tika-parsers-1.28.5 to 3.2.2 [jmeter]
Posted by "vlsi (via GitHub)" <gi...@apache.org>.
vlsi commented on issue #6497:
URL: https://github.com/apache/jmeter/issues/6497#issuecomment-3468454443
Frankly, I think the patch is to kill tika-parsers.jar file altogether.
I would say it is 99.9% that you do not use tika-parsers.jar. I think JMeter would start and operate as usual, however, I am not sure.
The upcoming JMeter release would not include tika-parsers module (even 2.0 version of it), only tika-core would be there.
See https://github.com/apache/jmeter/blob/832c3b2edc05521fc6f5c5751a2ad0a24e18d0e0/src/dist/src/dist/expected_release_jars.csv
---
Let met clarify the use case:
a) JMeter user configures a text assertion like "the response should contain <<order completed>> message"
b) Server API responds with a PDF file to JMeter
c) JMeter uses Tika to parse the PDF and check for <<order completed>> there.
Do you think your team might have ever used such a feature?
I don't think so.
On top of that, even though JMeter ships with `tika-parsers.jar`, JMeter does **not** bundle pdf parser jar itself. In other words, if you even try implementing the scenario like "text assertion on pdf contents", then you would **have** to manually add a pdf parsing jar to JMeter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jmeter.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Vulnerability CVE-2025-54988: upgrade tika-core-1.28.5 and tika-parsers-1.28.5 to 3.2.2 [jmeter]
Posted by "vlsi (via GitHub)" <gi...@apache.org>.
vlsi closed issue #6497: Vulnerability CVE-2025-54988: upgrade tika-core-1.28.5 and tika-parsers-1.28.5 to 3.2.2
URL: https://github.com/apache/jmeter/issues/6497
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jmeter.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Vulnerability CVE-2025-54988: upgrade tika-core-1.28.5 and tika-parsers-1.28.5 to 3.2.2 [jmeter]
Posted by "vlsi (via GitHub)" <gi...@apache.org>.
vlsi commented on issue #6497:
URL: https://github.com/apache/jmeter/issues/6497#issuecomment-3506817934
Fixed in https://github.com/apache/jmeter/pull/6556
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jmeter.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org