HIGH7.5

GHSA-rjx9-2936-9ffx

Improper Input Validation in Apache Sanselan

Details

Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.sanselan:sanselan

Introduced in: 0

No fixed version published yet for org.apache.sanselan:sanselan (maven). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-17201[ADVISORY]
https://lists.apache.org/thread.html/cd37861963aa6d2694c8947d464c99614d3e1a9db6c1a2a8b7b5840a@%3Cdev.commons.apache.org%3E[WEB]