[IMAGING-343] Apache Commons Imaging 0.97 - CVE-2018-17202

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.97
• Fix Version/s: 1.0-alpha1
• Assignee: Unassigned
• Reporter: Nikhil
• Created: 16/Jan/23 05:04
• Updated: 16/Jan/23 20:33
• Resolved: 16/Jan/23 20:33

Description

Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.

 

See https://nvd.nist.gov/vuln/detail/CVE-2018-17202 for more details.

 

There is Apache Commons Imaging 1.0-alpha3 version available.. but we are trying to understand if a new GA will be made available and also to see if this specific CVE is addressed in the latest versions ?

 

Please help