Patchfirst
Patchfirst
ChainApache TikaMaven:org.apache.tika:tika-core

Apache Tika: incomplete fixes (2022)

3 CVEs over 3 generations, 16 May 2022 to 27 Jun 2022.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2022-3012616 May 2022 First in the chain
  2. CVE-2022-3097331 May 2022 related to CVE-2022-30126
  3. CVE-2022-3387927 Jun 2022 incomplete fix for CVE-2022-30126incomplete fix for CVE-2022-30973
16 May 202223 May31 May12 Jun27 Jun CVE-2022-30126 → CVE-2022-30973: related (high confidence)CVE-2022-30126 → CVE-2022-33879: incomplete fix (high confidence)CVE-2022-30973 → CVE-2022-33879: incomplete fix (high confidence) CVE-2022-30126 16 May 2022 CVE-2022-30973 31 May 2022 CVE-2022-33879 27 Jun 2022 16 May 202222 May31 May8 Jun16 Jun27 Jun CVE-2022-30126 → CVE-2022-30973: related (high confidence)CVE-2022-30126 → CVE-2022-33879: incomplete fix (high confidence)CVE-2022-30973 → CVE-2022-33879: incomplete fix (high confidence) CVE-2022-30126 16 May 2022 CVE-2022-30973 31 May 2022 CVE-2022-33879 27 Jun 2022
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2022-30126 16 May 2022 Apache Tika Regular Expression Denial of Service in Standards Extractor · fixed in 2.4.0 First in chain 17.1
CVE-2022-30973 31 May 2022 Missing fix for CVE-2022-30126 in 1.28.2 · fixed in 1.28.3 CVE-2022-30126 · related · High 16.1
CVE-2022-33879 27 Jun 2022 Incomplete fix and new regex DoS in StandardsExtractingContentHandler · fixed in 2.4.1 CVE-2022-30126 · incomplete fix · High 16.2
↑ ↓ chooseEnter openEsc close