[TIKA-3232] security vulnerability in dependencies

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.24.1
• Fix Version/s: 1.25
• Assignee: Tim Allison
• Reporter: Shayne Grant
• Created: 19/Nov/20 21:04
• Updated: 19/Nov/20 22:06
• Resolved: 19/Nov/20 21:43

Description

Our team runs BlackDuck to find security vulnerabilities and Tika 1.24.1 was flagged in a recent scan for two libraries that it includes.  Here is information about the two libraries which have vulnerabilities and have been recently patched which Tika needs to upgrade to:

 

Apache HttpClient v4.5.12

The recommendation is to upgrade 4.5.13.  I cannot find a CVE number however the BlackDuck tool has pointed to the following changeset that was made in the 4.5.13 version that addresses the vulnerability

https://github.com/apache/httpcomponents-client/commit/e628b4c5c464c2fa346385596cc78e035a91a62e

 

jackson-databind 2.10.3

The recommendation is to upgrade to 2.11.3.  The issue was CVE-2020-25649