CVE-2018-1338

Vulnerability

Apache Tika versions before 1.18 contain an infinite loop vulnerability in the BPGParser class when processing a specially crafted or fuzzed BPG image file [3]. The parser does not properly validate the file structure, leading to a loop that never terminates.

Exploitation

An attacker can exploit this vulnerability by providing a malicious BPG file to Apache Tika for parsing [1]. No authentication is required; the attacker only needs the ability to submit a crafted file to an application that uses the vulnerable Tika library (e.g., via file upload or URL fetching). The parsing process will enter an infinite loop, consuming CPU resources indefinitely.

Impact

Successful exploitation results in a denial-of-service condition (availability impact). The infinite loop consumes a single CPU core until the process is terminated or the thread is interrupted. No data confidentiality or integrity is compromised [1] [3].

Mitigation

The fix is included in Apache Tika version 1.18 and later [3]. Red Hat Fuse 7.1 includes the patched version [1]. Users should upgrade to Tika 1.18 or apply the relevant Red Hat security update. As a workaround, if upgrading is not immediately possible, disable BPG file support or restrict file uploads and processing to trusted sources only.