{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e68dccf5-8d05-5f1c-b359-0d85f874c934", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3", "type": "library", "group": "org.apache.tika", "name": "tika-detector-siegfried", "version": "2.9.4-tuxcare.3", "purl": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8eb1acaf-da25-5700-9f84-d3314e786aa8", "id": "CVE-2012-6612", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2012-6612 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. Version 2.9.4 is not affected by CVE-2012-6612: the security fix is already present in the target branch. Momus prerequisite check: \"All 7 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:38603628-64b4-5916-9fb2-3a83a4122d10", "id": "CVE-2013-6397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6397 affects version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4fc4bc86-cf99-500c-b446-dff6476d46d6", "id": "CVE-2013-6407", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6407 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. Version 2.9.4 is not affected by CVE-2013-6407: the security fix is already present in the target branch. Momus prerequisite check: \"All 4 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e6209bf7-a003-5ea9-98c5-15c2904e51dd", "id": "CVE-2013-6408", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6408 affects version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:35fce4a9-04f6-50df-b3a9-6ae8ef3b8973", "id": "CVE-2015-3415", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2015-3415 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2015-3415 is a defect in the SQLite C library: sqlite3VdbeExec in src/vdbe.c mishandles the MEM_Dyn flag on registers when comparison operators revert an affinity change, so a crafted CHECK clause such as CHECK(0&O>O) in a CREATE TABLE statement can cause an invalid free. The SQLite project fixed it in its own repository, in check-in 02e3c88fbf6abdcf3975fb0fb71972b0ab30da30 to src/vdbe.c, released in SQLite 3.8.9, and NVD records the flaw against SQLite.\n\nApache Tika is a Java library and contains no SQLite engine code; no SQLite C sources have ever existed anywhere in its history. Its SQLite support is a JDBC client only - SQLite3Parser, SQLite3DBParser and SQLite3TableReader in tika-parser-sqlite3-module - which can reach an engine only through the declared org.xerial:sqlite-jdbc dependency.\n\nThe vulnerability is therefore in SQLite, not in Apache Tika, in any version." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d3218ed6-ec57-51fe-94a0-314396810000", "id": "CVE-2015-3416", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2015-3416 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2015-3416 is a defect in the SQLite database engine itself: sqlite3VXPrintf in printf.c mishandles precision and width values during floating-point conversions, so a crafted printf call inside a SELECT statement can trigger an integer overflow and a stack-based buffer overflow. NVD records the affected products as SQLite before 3.8.9 and the PHP builds that embed it. The fix was made by the SQLite project and released in SQLite 3.8.9.\n\nApache Tika contains no part of the SQLite engine. Its SQLite support is Java only: the tika-parser-sqlite3-module classes SQLite3Parser, SQLite3DBParser and SQLite3TableReader reach SQLite through the JDBC API (org.sqlite.JDBC, org.sqlite.SQLiteConfig), and the engine is supplied by the separate org.xerial sqlite-jdbc artifact. No release of Tika has ever carried printf.c or any other SQLite source.\n\nThe vulnerability therefore does not apply to this library." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e5570322-b539-55f8-9a65-c96af1fc7287", "id": "CVE-2015-3717", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2015-3717 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. vulnerabilikity is in SQLite, not tika" }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:da4bdd23-6261-5473-8bc2-987a5241a06c", "id": "CVE-2015-5895", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2015-5895 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2015-5895 covers unspecified vulnerabilities in the SQLite C library before 3.8.10.2, as shipped in Apple iOS before 9. NVD records it against SQLite and Apple iOS only, with the CPEs cpe:2.3:a:sqlite:sqlite and cpe:2.3:o:apple:iphone_os, and every reference points to Apple's iOS 9 security advisory of September 2015. There is no Apache Tika CPE.\n\nApache Tika contains no SQLite engine code in any version. Its SQLite support is a JDBC client: in tika-parser-sqlite3-module, SQLite3Parser, SQLite3DBParser and SQLite3TableReader load the org.sqlite.JDBC driver and read tables through java.sql. The tree holds no C sources, no SQLite amalgamation, and no vendored or shaded copy of the engine; the engine can reach an application only through the org.xerial:sqlite-jdbc dependency.\n\nThe vulnerability therefore does not apply to this library." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:35252105-d219-5e41-8586-3706f35ce475", "id": "CVE-2017-3163", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-3163 affects version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:777e0270-8b2d-51b4-bd99-e42ae2099a35", "id": "CVE-2018-20346", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-20346 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2018-20346 is a flaw in SQLite itself: with the FTS3 extension enabled, an integer overflow and resultant buffer overflow occur on FTS3 queries issued after crafted changes to FTS3 shadow tables, fixed in SQLite 3.25.3. NVD and OSV record it against SQLite, Google Chrome and operating-system distributions; neither lists Apache Tika or any Java package.\n\nApache Tika contains no implementation of SQLite in any version. The tree holds no C sources, no native libraries and no vendored or shaded copy of the SQLite engine. Its only relationship to SQLite is a Maven dependency on org.xerial:sqlite-jdbc, used by tika-parser-sqlite3-module, whose SQLite3DBParser imports org.sqlite.SQLiteConfig and opens a JDBC connection through the driver. The overflowing code is the driver's bundled native SQLite library, not this library's code.\n\nThe vulnerability therefore does not apply to Apache Tika." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a33c9cd3-ef9d-5ad3-a6c9-c70d2d118807", "id": "CVE-2018-20505", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-20505 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2018-20505 is a flaw in the SQLite C library. The upstream fix, check-in c6e519f3 for ticket 1a84668dcfdebaf12415d, released in SQLite 3.25.3, corrects an assertion in the query planner (src/wherecode.c, removeUnindexableInClauseTerms) reached by row-value operations against a PRIMARY KEY containing duplicate columns. NVD records the affected products as SQLite up to 3.25.2 and several Apple operating systems and applications; no Java package is listed.\n\nApache Tika contains no SQLite implementation. The tree holds no C or native sources and no vendored, shaded or repackaged SQLite code; tika-parser-sqlite3-module reads .sqlite files only through the third-party org.xerial:sqlite-jdbc driver, declared as an ordinary dependency.\n\nThe vulnerable code is therefore never Apache Tika's own code, in this or any version." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:75e1722e-cc79-559b-a6ce-18048bdd7aac", "id": "CVE-2018-20506", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-20506 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. \u0421VE in SQLite, not in tika" }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e2cf7ac3-da72-5a5a-a367-8cbb199b93fe", "id": "CVE-2018-8740", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-8740 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2018-8740 is a defect in the SQLite database engine itself: in SQLite through 3.22.0, a schema corrupted with a CREATE TABLE AS statement causes a NULL pointer dereference in src/build.c and src/prepare.c. NVD records the affected product as SQLite up to 3.22.0, and every reference points to the SQLite project's own timeline and patch.\n\nApache Tika contains no SQLite code. The Tika codebase has never held SQLite's C sources or a compiled SQLite library in any version; LICENSE.txt notes only that SQLite is bundled inside org.xerial's sqlite-jdbc. Tika's own SQLite support is Java only: SQLite3Parser and SQLite3DBParser drive that driver over JDBC.\n\nThe vulnerable code is therefore never Tika's, in any version, and the flaw applies to the SQLite engine shipped by that third-party driver rather than to this library." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ff5a38fa-2697-572d-8844-d233f1f45316", "id": "CVE-2019-19645", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-19645 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. not_affected \u2014 Target Apache Tika 2.9.4-tuxcare.9 uses SQLite version 3.49.1.0 via org.xerial:sqlite-jdbc dependency. CVE-2019-19645 affects SQLite through version 3.30.1 (infinite recursion in alter.c when processing ALTER TABLE statements on self-referential views). Since 3.49.1.0 >> 3.30.1, the vulnerable code pattern is not present. The fix was applied by upstream SQLite project and inherited through Apac..." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5420a05a-5311-58cb-b0e4-34d4ee281608", "id": "CVE-2019-19646", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2019-19646 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2019-19646 is a defect in SQLite's own C source: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. NVD records the flaw against SQLite through 3.30.1, and SQLite fixed it in release 3.31.0.\n\nApache Tika is a Java library and contains no SQLite code. Its tree carries no sqlite3.c, no pragma.c and no bundled SQLite native library, neither in this version nor at any point in its history. SQLite is reached only through the separate third-party JDBC driver org.xerial:sqlite-jdbc, declared as a dependency of tika-parser-sqlite3-module; Tika's own parser classes SQLite3DBParser and SQLite3TableReader issue only ordinary JDBC queries.\n\nThe vulnerable code therefore belongs to a different product and is never Apache Tika's own code, in any version." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8f843fb1-52e0-5fff-82cb-7283bc749b75", "id": "CVE-2020-11655", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-11655 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2020-11655 is a defect in the SQLite C library: through SQLite 3.31.1, a malformed window-function query mishandles initialization of the AggInfo object and can crash the process. NVD records the flaw against sqlite/sqlite and against operating-system and product distributors of that C library, and every reference points to SQLite's own ticket af4556bb5c and check-in 4a302b42c7bf5e11. The fix landed in SQLite 3.32.0, in C code.\n\nApache Tika contains no SQLite implementation in any version. Its SQLite support is JDBC glue only: SQLite3Parser and SQLite3DBParser open a JDBC connection and issue SELECT statements, and the SQLite engine itself reaches Tika solely as the native library inside the third-party org.xerial:sqlite-jdbc artifact. The tree holds no sqlite3.c, no sqlite3.h, and no AggInfo or window-function code.\n\nThe vulnerability therefore does not apply to Apache Tika in any version." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d8e806a6-71fa-560f-8bcf-b3389a592e93", "id": "CVE-2020-11656", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-11656 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2020-11656 is a use-after-free in the ALTER TABLE implementation of the SQLite C library, reachable through an ORDER BY clause that belongs to a compound SELECT. It affects SQLite up to 3.31.1 and was fixed in SQLite 3.32.0; SQLite records it as a read-only use-after-free that occurs only in builds compiled with -DSQLITE_DEBUG. NVD lists the flaw solely against cpe:2.3:a:sqlite:sqlite:*, with no Apache Tika product entry.\n\nApache Tika contains no SQLite code. Its entire history holds no SQLite C sources, and its only SQLite-related code, tika-parser-sqlite3-module, is Java that opens databases through the JDBC API: SQLite3DBParser calls SQLiteConfig.createConnection. The SQLite engine reaches Tika only inside the third-party artifact org.xerial:sqlite-jdbc, declared as an external dependency.\n\nThe vulnerability is therefore not in Apache Tika's code in any version." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:616e16e6-599b-5a85-8c8d-11d62f800f3c", "id": "CVE-2020-13434", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13434 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. not_affected \u2014 CVE-2020-13434 affects SQLite through version 3.32.0 (integer overflow in sqlite3_str_vappendf in printf.c). The target uses sqlite-jdbc 3.49.1.0, which bundles SQLite 3.49.1\u2014significantly newer than both the vulnerable version (3.32.0) and the fix version (3.34.0) introduced by upstream patches. The vulnerable C code exists only in the sqlite-jdbc dependency, not in Tika's repository. The depe..." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0fe9e30c-674f-5a7b-ada3-83d6ad64fdeb", "id": "CVE-2020-13435", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13435 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. not_affected \u2014 CVE-2020-13435 affects SQLite through version 3.32.0. The target (Apache Tika 2.9.4-tuxcare.9) uses sqlite-jdbc 3.49.1.0, which bundles native SQLite 3.49.1 - well beyond the vulnerable version range. The upstream vendor (Apache Software Foundation) fixed this vulnerability in September 2020 by upgrading from sqlite-jdbc 3.31.1 to 3.32.3.2 (commit 46e17b4625a by tallison@apache.org). TuxCare fo..." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b54b14da-efbc-56ef-a1b9-a01b0222227a", "id": "CVE-2020-13630", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-13630 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2020-13630 is a use-after-free in SQLite's own C implementation: ext/fts3/fts3.c mishandles memory in fts3EvalNextRow when the FTS3 snippet() function is used. SQLite fixed it in check-in 0d69f76f0865f962, released in SQLite 3.32.0, and NVD records the affected product as SQLite together with the operating systems and applications that embed it.\n\nApache Tika contains no part of that implementation. It has never carried SQLite's C sources in any release; the tree holds no fts3 code and no native SQLite library. Tika reads SQLite databases only through JDBC, in the sqlite3 parser module, whose SQLite3DBParser and JDBCTableReader issue nothing but SELECT name FROM sqlite_master and SELECT * from a table name - no full-text-search query and no snippet() call.\n\nThe vulnerability lies in a separate third-party component, not in this library." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ecee8293-cd2c-5762-a13e-609275bcd0c2", "id": "CVE-2020-13631", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13631 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. not_affected \u2014 The target repository (Apache Tika 2.9.4-tuxcare.9) is NOT AFFECTED by CVE-2020-13631. The CVE affects SQLite before version 3.32.0, which allows virtual tables to be renamed to shadow table names. The target uses SQLite version 3.49.1.0 (via org.xerial:sqlite-jdbc dependency), which is far beyond the fixed version 3.32.0. The vulnerability was addressed by upstream Apache Tika in December 2020..." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:be03343e-09d9-5c08-b824-3187ad49b69e", "id": "CVE-2020-13632", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13632 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. not_affected \u2014 CVE-2020-13632 affects SQLite versions before 3.32.0. The target uses org.xerial:sqlite-jdbc version 3.49.1.0 (declared in tika-parent/pom.xml), which is well above the fixed version. The vulnerability was eliminated when Apache Tika updated the dependency from 3.31.1 to 3.32.3.2 in upstream commit a504d7e7e (TIKA-3119) by tallison@apache.org. Since this is an upstream vendor fix (not a TuxCare..." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dafa70b6-a977-5089-889a-d29d6289ec00", "id": "CVE-2020-15358", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-15358 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. not_affected \u2014 CVE-2020-15358 affects SQLite before version 3.32.3. Apache Tika 2.9.4-tuxcare.9 uses org.xerial:sqlite-jdbc version 3.49.1.0, which contains SQLite 3.49.1. This version is significantly newer than 3.32.3 and includes the fix for the query-flattener optimization vulnerability. The vulnerable code pattern is not present in the version used by the target. The fix was applied by upstream Apache Ti..." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:187a3df5-2de9-533d-9e09-a9311366b36d", "id": "CVE-2022-35737", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-35737 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2022-35737 is an array-bounds overflow in the native SQLite C library, in the printf implementation in src/printf.c. It is reachable only through SQLite's C-language APIs when a string argument longer than about two billion bytes is passed to the %q, %Q or %w quote-escaping specifiers, and SQLite states it cannot be reached through SQL or by supplying a corrupt database file. It was fixed in SQLite 3.39.2.\n\nApache Tika contains no SQLite implementation in any version. Its SQLite support is a JDBC client: SQLite3Parser, SQLite3DBParser and SQLite3TableReader in tika-parser-sqlite3-module open a read-only connection through org.sqlite.JDBC and read tables with prepared statements. The vulnerable C code lives in the native library compiled into the org.xerial:sqlite-jdbc artifact, never in this project's own sources.\n\nThe vulnerability therefore does not apply to this library." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2e02d5ef-b37b-537e-b6f0-2409999a028c", "id": "CVE-2023-34610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-34610 is fixed in version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9c837687-8cf3-5828-b069-552be55c0930", "id": "CVE-2023-7104", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-7104 is a false positive for org.apache.tika:tika-detector-siegfried 2.9.4-tuxcare.3. CVE-2023-7104 is a heap buffer overread in the SQLite C library's session extension: sessionReadRecord in ext/session/sqlite3session.c mis-validates bounds while parsing a corrupt changeset. NVD records the affected product as SQLite up to 3.43.0, and the fix is SQLite check-in 0e4e7a05c4204b47, first released in SQLite 3.43.1.\n\nApache Tika implements no part of SQLite. The tree carries no SQLite C sources and no bundled native SQLite library. Its only SQLite code is Java, in tika-parser-sqlite3-module: SQLite3DBParser opens a read-only jdbc:sqlite: connection through the org.sqlite.JDBC driver and reads table names and rows with SELECT statements. It never touches the session or changeset API.\n\nThe vulnerable code is therefore not this library's code in any version. It exists only in the SQLite C library compiled into the separate org.xerial:sqlite-jdbc artifact." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5f7438d9-1b5d-5ebf-bcc1-b1e7bc5849b9", "id": "CVE-2024-31141", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-31141 affects version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:10dfcfef-33d4-5cf9-97b6-03268f4996b7", "id": "CVE-2024-56128", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-56128 does not affect version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried. not_affected \u2014 Apache Tika 2.9.4-tuxcare.9 is not affected by CVE-2024-56128. The target uses kafka-clients version 3.9.0, which is a fixed version that includes the SCRAM nonce validation fix. The vulnerability affects kafka-clients < 3.7.2, 3.8.0, and 3.8.x (excluding 3.8.1). The fix was applied by upstream Apache Tika developer Tilman Hausherr in commit 6d2ab9ab5 (Nov 9, 2024), not by TuxCare. The vulnerab..." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4b36503d-f08c-5956-b147-292a0786e1ab", "id": "CVE-2025-27819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27819 affects version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0af11270-59f8-534f-81dd-1988306405af", "id": "CVE-2025-54988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-54988 is fixed in version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4e9c3bbc-30e7-5e01-a529-2b4b0e034f4c", "id": "CVE-2025-66516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66516 is fixed in version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1f4a93ce-1971-5dd0-8d79-d5908fa55b23", "id": "CVE-2026-66755", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66755 affects version 2.9.4-tuxcare.3 of org.apache.tika:tika-detector-siegfried." }, "affects": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tika/tika-detector-siegfried@2.9.4-tuxcare.3" } ] }