HIGH7.5

GHSA-g99m-3m46-4gm9

Infinite Loop in Apache Sanselan

Details

Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.sanselan:sanselan

Introduced in: 0

No fixed version published yet for org.apache.sanselan:sanselan (maven). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-17202[ADVISORY]
https://lists.apache.org/thread.html/69204376d12205b0d2d90e6fcbeebb99b894e6db88c8ff565c4e1efa@%3Cdev.commons.apache.org%3E[WEB]