You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
Vulnerable Library - poi-scratchpad-3.14.jar
Apache POI - Java API To Access Microsoft Format Files
Library home page: http://poi.apache.org/
Path to dependency file: /nifi-nar-bundles/nifi-email-bundle/nifi-email-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-email-bundle/nifi-email-processors/pom.xml
Found in HEAD commit: d672f5c3ea38dd0e23359cf12d310c2c27abf963
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2017-12626
Vulnerable Library - poi-scratchpad-3.14.jar
Apache POI - Java API To Access Microsoft Format Files
Library home page: http://poi.apache.org/
Path to dependency file: /nifi-nar-bundles/nifi-email-bundle/nifi-email-processors/pom.xml
Path to vulnerable library: /nifi-nar-bundles/nifi-email-bundle/nifi-email-processors/pom.xml
Dependency Hierarchy:
Found in HEAD commit: d672f5c3ea38dd0e23359cf12d310c2c27abf963
Found in base branch: master
Vulnerability Details
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
Publish Date: 2018-01-26
URL: CVE-2017-12626
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b@%3Cdev.poi.apache.org%3E
Release Date: 2018-01-26
Fix Resolution: 3.17-beta1
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: