[OAK-10546] Tika 1.28.5 references a vulnerable Guava version

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Won't Do
• Component/s: oak-examples, oak-run, oak-search-elastic, oak-solr-core
• Assignee: Fabrizio Fortino
• Reporter: Fabrizio Fortino
• Created: 09/Nov/23 13:01
• Updated: 05/Apr/24 11:46
• Resolved: 02/Apr/24 08:35

Description

Guava 31.1 has a critical vulnerability [0]. It is included as a transient dependency of Tika 1.28.5 [1]. This is the latest 1.x available release of Tika. Being EOL it won't receive any security-related updates [2].

The work to upgrade to Tika 2.x would require some time.

If possible, we should find an alternative solution to avoid including this vulnerable dependency.

[0] https://www.opencve.io/cve/CVE-2023-2976 

[1] https://mvnrepository.com/artifact/org.apache.tika/tika-parsers/1.28.5

[2] https://lists.apache.org/thread/yq6n7o01kw544dvj1jsoqk29g6yqjkp3 

Issue Links

• is related to: TIKA-4236 tika-parser-nlp-module has an unnecessary Guava dependency
• is related to: OAK-9752 Update Tika version to 2.x
• links to: GitHub Pull Request #1201