advisories/apache-tika-3.2.advisories.yaml at main · jamie-albert/advisories · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
schema-version: 2.0.2

package:
  name: apache-tika-3.2

advisories:
  - id: CGA-7rr5-qmg3-68qx
    aliases:
      - CVE-2025-68161
      - GHSA-vc5p-v9hr-52mj
    events:
      - timestamp: 2025-12-20T11:21:45Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-tika-3.2
            componentID: 41660ee0e918259c
            componentName: log4j-core
            componentVersion: 2.25.1
            componentType: java-archive
            componentLocation: /usr/share/java/tika-server-standard-3.2.3.jar
            scanner: grype
      - timestamp: 2025-12-29T17:51:01Z
        type: fixed
        data:
          fixed-version: 3.2.3-r2

  - id: CGA-j3pm-j558-6r52
    aliases:
      - CVE-2025-48924
      - GHSA-j288-q9x7-2f5v
    events:
      - timestamp: 2025-07-12T07:09:51Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-tika-3.2
            componentID: ad593f17f88507fe
            componentName: commons-lang3
            componentVersion: 3.17.0
            componentType: java-archive
            componentLocation: /usr/share/java/tika-server-standard-3.2.1.jar
            scanner: grype
      - timestamp: 2025-07-15T10:07:10Z
        type: fixed
        data:
          fixed-version: 3.2.1-r1

  - id: CGA-j59v-8frm-88rh
    aliases:
      - CVE-2025-48795
      - GHSA-36wv-v2qp-v4g4
    events:
      - timestamp: 2025-07-17T07:04:32Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-tika-3.2
            componentID: 3e7e998d7e795430
            componentName: cxf-core
            componentVersion: 4.0.6
            componentType: java-archive
            componentLocation: /usr/share/java/tika-server-standard-3.2.1.jar
            scanner: grype
      - timestamp: 2025-07-21T09:31:07Z
        type: fixed
        data:
          fixed-version: 3.2.1-r3

  - id: CGA-rx2v-86g5-c3jm
    aliases:
      - CVE-2024-6763
      - GHSA-qh8g-58pp-2wxh
    events:
      - timestamp: 2025-06-30T15:35:15Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-tika-3.2
            componentID: 48be9dd291ac9545
            componentName: jetty-http
            componentVersion: 11.0.25
            componentType: java-archive
            componentLocation: /usr/share/java/tika-server-standard-3.2.0.jar
            scanner: grype
      - timestamp: 2025-07-03T13:08:26Z
        type: pending-upstream-fix
        data:
          note: |
            "Updating the jetty-http dependency of a major version let the application failing at start. Upstream needs to properly update the dependency and once that is done, we can update it in order to fix the vulnerability."