{"id":"CVE-2018-11761","aliases":["DEBIAN-CVE-2018-11761","EUVD-2018-0520","GHSA-6jq2-789q-fff2","SUSE-RU-2018:4018-1","SUSE-SU-2018:4011-1","UBUNTU-CVE-2018-11761"],"status":"published","title":"High severity vulnerability that affects org.apache.tika:tika-core","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.09456,"percentile":0.95462,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-611"],"published":"2018-09-19T14:00:00Z","modified":"2026-11-04T20:01:36Z","exploits":[{"source":"pocgithub","id":"brianwrf/CVE-2018-11761","title":"brianwrf/CVE-2018-11761","date":"2019-01-23","url":"https://github.com/brianwrf/CVE-2018-11761"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tika:tika-core","fixed_in":["1.19.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:11","package":"tika","fixed_in":["1.20-1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-web","fixed_in":["2.8.7.11-3.13.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"apache-mybatis","fixed_in":["3.2.3-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"cobbler","fixed_in":["2.6.6-6.10.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"hadoop","fixed_in":["0.18.1-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"image-sync-formula","fixed_in":["0.1.1542287363.b8aa274-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"lucene","fixed_in":["2.4.1-4.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"nekohtml","fixed_in":["1.9.21-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"nutch-core","fixed_in":["1.0.1-7.10.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"picocontainer","fixed_in":["1.3.7-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"python-susemanager-retail","fixed_in":["1.0.1542643545.8752d17-2.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"salt-netapi-client","fixed_in":["0.15.0-4.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"saltboot-formula","fixed_in":["0.1.1542287363.b8aa274-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacecmd","fixed_in":["2.8.25.7-3.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-branding","fixed_in":["2.8.5.12-3.10.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-config","fixed_in":["2.8.5.5-3.10.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","fixed_in":["2.8.78.13-3.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-search","fixed_in":["2.8.3.7-3.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-setup","fixed_in":["2.8.7.5-3.10.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-utils","fixed_in":["2.8.18.3-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","fixed_in":["2.8.7.11-3.13.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager","fixed_in":["3.2.14-3.13.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-docs_en","fixed_in":["3.2-11.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-frontend-libs","fixed_in":["3.2.4-3.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-schema","fixed_in":["3.2.15-3.13.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sls","fixed_in":["3.2.18-3.13.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sync-data","fixed_in":["3.2.10-3.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"tika-core","fixed_in":["1.19.1-3.3.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tika:tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1"},{"fixed":"1.19.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tika:tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1"},{"fixed":"1.19.1"}]}],"versions":["0.10","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.11-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"apache-mybatis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-6.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"hadoop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1542287363.b8aa274-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"lucene","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-4.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"nekohtml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.21-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"nutch-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-7.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"picocontainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"python-susemanager-retail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1542643545.8752d17-2.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-4.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1542287363.b8aa274-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.25.7-3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.12-3.10.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.5-3.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.78.13-3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3.7-3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.5-3.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18.3-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.11-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.14-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-11.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-frontend-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-3.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.18-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.11-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"apache-mybatis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-6.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"hadoop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1542287363.b8aa274-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"lucene","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-4.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"nekohtml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.21-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"nutch-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-7.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"picocontainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"python-susemanager-retail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1542643545.8752d17-2.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-4.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1542287363.b8aa274-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.25.7-3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.12-3.10.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.5-3.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.78.13-3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3.7-3.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.5-3.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18.3-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.11-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.14-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-11.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-frontend-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-3.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.18-3.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.1-3.3.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-2","1.5-3","1.5-4","1.5-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2"]}],"products":[{"vendor":"apache","product":"tika"},{"vendor":"apache software foundation","product":"apache tika"},{"vendor":"oracle","product":"business_process_management_suite"}],"references":[{"url":"http://www.securityfocus.com/bid/105514","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.apache.org/thread.html/5553e10bba5604117967466618f219c0cae710075819c70cfb3fb421%40%3Cdev.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11761","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6jq2-789q-fff2","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/5553e10bba5604117967466618f219c0cae710075819c70cfb3fb421@%3Cdev.tika.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-11761","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20184018-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1041999","tags":["report"]},{"url":"https://bugzilla.suse.com/1080474","tags":["report"]},{"url":"https://bugzilla.suse.com/1083094","tags":["report"]},{"url":"https://bugzilla.suse.com/1104487","tags":["report"]},{"url":"https://bugzilla.suse.com/1105359","tags":["report"]},{"url":"https://bugzilla.suse.com/1105724","tags":["report"]},{"url":"https://bugzilla.suse.com/1106430","tags":["report"]},{"url":"https://bugzilla.suse.com/1106626","tags":["report"]},{"url":"https://bugzilla.suse.com/1107869","tags":["report"]},{"url":"https://bugzilla.suse.com/1109235","tags":["report"]},{"url":"https://bugzilla.suse.com/1110361","tags":["report"]},{"url":"https://bugzilla.suse.com/1110625","tags":["report"]},{"url":"https://bugzilla.suse.com/1111247","tags":["report"]},{"url":"https://bugzilla.suse.com/1111249","tags":["report"]},{"url":"https://bugzilla.suse.com/1111387","tags":["report"]},{"url":"https://bugzilla.suse.com/1111497","tags":["report"]},{"url":"https://bugzilla.suse.com/1111542","tags":["report"]},{"url":"https://bugzilla.suse.com/1111810","tags":["report"]},{"url":"https://bugzilla.suse.com/1111966","tags":["report"]},{"url":"https://bugzilla.suse.com/1112163","tags":["report"]},{"url":"https://bugzilla.suse.com/1112445","tags":["report"]},{"url":"https://bugzilla.suse.com/1112754","tags":["report"]},{"url":"https://bugzilla.suse.com/1113557","tags":["report"]},{"url":"https://bugzilla.suse.com/1113747","tags":["report"]},{"url":"https://bugzilla.suse.com/1114181","tags":["report"]},{"url":"https://bugzilla.suse.com/1114362","tags":["report"]},{"url":"https://bugzilla.suse.com/1114814","tags":["report"]},{"url":"https://bugzilla.suse.com/1114991","tags":["report"]},{"url":"https://bugzilla.suse.com/1115449","tags":["report"]},{"url":"https://bugzilla.suse.com/1116517","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11761","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184011-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-11761","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2018/09/19/4","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11761","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-11761","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","status":"published","published":"2018-09-19T14:00:00Z","modified":"2024-09-16T18:39:59.951Z","updated_at":"2026-11-02T14:35:09.139955Z"}],"euvd":[{"id":"EUVD-2018-0520","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","status":"published","published":"2018-09-19T14:00:00Z","modified":"2024-09-16T18:39:59Z","updated_at":"2026-11-03T00:55:30.209098Z"}],"ghsa":[{"id":"GHSA-6jq2-789q-fff2","title":"High severity vulnerability that affects org.apache.tika:tika-core","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","status":"published","published":"2018-10-17T15:49:36Z","modified":"2023-01-09T05:02:34Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:03.040255Z"}],"nvd":[{"id":"CVE-2018-11761","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","status":"published","published":"2018-09-19T14:29:00.287Z","modified":"2026-06-17T01:36:31.9Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"CVE-2018-11761","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","status":"published","published":"2018-09-19T14:29:00.287Z","modified":"2026-10-24T10:30:39.308419093Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-11761","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","status":"published","published":"2018-09-19T14:29:00.287Z","modified":"2026-08-04T06:04:19.909471064Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"GHSA-6jq2-789q-fff2","title":"High severity vulnerability that affects org.apache.tika:tika-core","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","status":"published","published":"2018-10-17T15:49:36Z","modified":"2023-11-08T03:59:46.823518Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"UBUNTU-CVE-2018-11761","description":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.","status":"published","published":"2018-09-19T14:29:00Z","modified":"2026-11-04T20:01:36.608564752Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T14:21:51.627602Z"},{"id":"SUSE-RU-2018:4018-1","title":"Security update for SUSE Manager Server 3.2","description":"\nThis update fixes the following issues:\n\napache-mybatis:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n\ncobbler:\n\n- Fix service restart after logrotate for cobblerd (bsc#1113747)\n- Rotate cobbler logs at higher frequency to prevent disk fillup\n  (bsc#1113747)\n\nhadoop:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n\nimage-sync-formula:\n\n- Handle empty images pillar (bsc#1105359)\n\nlucene:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n\nnekohtml:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n\nnutch-core:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n- Add conditional requirement for java 1.8 \n- Use java \u003e= 1.8 - required by tika 0.19.1 \n  to /var/log/nutch (bsc#1107869)\n- Add new tarball file for v1.0.1\n- Bump up version to 1.0.1 and fix paths\n- Adjustments after upgrade of tika-core to v1.19 \n\npicocontainer:\n\n- Install missing LICENSE.txt file (bsc#1114814) \n\npython-susemanager-retail:\n\n- Improve error reporting on duplicate systems\n- Output partition size as int (bsc#1116517)\n- Start partition numbers from 1\n- Warn on long group names\n- Improved logging support\n- Add retail_yaml --only-new option\n- Print import summary (bsc#1112754)\n- Add retail_migration tool\n- Check for duplicate addresses in yaml (bsc#1111497)\n\nsalt-netapi-client:\n\n- Version 0.15.0\n  See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.15.0\n\nsaltboot-formula:\n\n- Send pxe_update by external command to make sure it is finished\n  (bsc#1111387)\n- Better error message on missing partitioning pillar (bsc#1110625)\n\nspacecmd:\n\n- Show group id on group_details (bsc#1111542)\n- State channels handling: Existing commands configchannel_create and configchannel_import were updated\n  while system_scheduleapplyconfigchannels and configchannel_updateinitsls were added.\n\nspacewalk-branding:\n\n- Automatic cleanup of notification messages after a configurable lifetime\n- ActivationKey base and child channel in a reactjs component\n- New messages are added for XMLRPC API for state channels\n\nspacewalk-config:\n\n- Add permissions for tomcat \u0026 apache to check bootstrap ssh file (bsc#1114181)\n\nspacewalk-java:\n\n- Improve return value and errors thrown for system.createEmptyProfile XMLRPC endpoint\n- Fix scheduling jobs to prevent forever pending events (bsc#1114991)\n- Performance improvements for group listings and detail page (bsc#1111810)\n- Fix wrong counts of systems currency reports when a system belongs to more than one group (bsc#1114362)\n- Add check if ssh-file permissions are correct (bsc#1114181)\n- Increase maximum number of threads and open files for taskomatic (bsc#1111966)\n- When removing cobbler system record, lookup by mac address as well if lookup by id fails(bsc#1110361)\n- Allow listing empty system profiles via XMLRPC\n- Automatic cleanup of notification messages after a configurable lifetime\n- Different methods have been refactored in tomcat/taskomatic for better performance(bsc#1106430)\n- Do not try cleanup when deleting empty system profiles (bsc#1111247)\n- Better error handling when a websocket connection is aborted (bsc#1080474)\n- Change Requires to allow installing with both Tomcat 8 (SLE-12SP3) and 9 (SLE12-SP4)\n- ActivationKey base and child channel in a reactjs component\n- Fix typo in messages (bsc#1111249)\n- Cleanup formula data and assignment when migrating formulas or when removing system\n- Remove restrictions on SUSE Manager Channel subscriptions (bsc#1105724)\n- Added shortcut for editing Software Channel\n- Fix permissions check on formula list api call (bsc#1106626)\n- Add sp migration dry runs to the daily status report (bsc#1083094)\n\nspacewalk-search:\n\n- Fix nutch-core path (bsc#1112445)\n\nspacewalk-setup:\n\n- Increase maximum number of threads and open files for taskomatic (bsc#1111966)\n\nspacewalk-utils:\n\n- Fix typo at --phases option help\n\nspacewalk-web:\n\n- Make datetimepicker update displayed time (bsc#1041999)\n- Show human-readable system cleanup error messages\n- ActivationKey base and child channel in a reactjs component\n- Fix typo in messages (bsc#1111249)\n\nsusemanager:\n\n- Add new option --with-parent-channel to mgr-create-bootrap-repo\n  to specify parent channel to use if multiple options are available\n  (bsc#1104487)\n\nsusemanager-docs_en:\n\n- Update text and image files.\n- Add information about SLE12 SP4 as base OS for Server and Proxy\n\nsusemanager-frontend-libs:\n\n- Fix package version (bsc#1115449)\n\nsusemanager-schema:\n\n- Automatic cleanup of notification messages after a configurable lifetime\n- Add missing minion-action-chain-cleanup to db init scripts\n\nsusemanager-sls:\n\n- Deploy SSL certificate during onboarding of openSUSE Leap 15.0 (bsc#1112163)\n\nsusemanager-sync-data:\n\n- SUSE OpenStack Cloud 9 enablement (bsc#1113557)\n- Add SUSE Manager 3.1 and 3.2 to SLES12 SP4\n\ntika-core:\n\n- Fix improper XML parsing to prevent DoS attacks (CVE-2018-11761) (bsc#1109235)\n- Install missing LICENSE.txt file (bsc#1114814)\n- New upstream version (0.19.1) \n\n","status":"published","published":"2018-12-07T12:25:18Z","modified":"2026-02-04T04:10:52.911355Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2018:4011-1","title":"Security update for SUSE Manager Server 3.2","description":"\nThis update fixes the following issues:\n\napache-mybatis:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n\ncobbler:\n\n- Fix service restart after logrotate for cobblerd (bsc#1113747)\n- Rotate cobbler logs at higher frequency to prevent disk fillup\n  (bsc#1113747)\n\nhadoop:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n\nimage-sync-formula:\n\n- Handle empty images pillar (bsc#1105359)\n\nlucene:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n\nnekohtml:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n\nnutch-core:\n\n- Install missing LICENSE.txt file (bsc#1114814)\n- Add conditional requirement for java 1.8 \n- Use java \u003e= 1.8 - required by tika 0.19.1 \n  to /var/log/nutch (bsc#1107869)\n- Add new tarball file for v1.0.1\n- Bump up version to 1.0.1 and fix paths\n- Adjustments after upgrade of tika-core to v1.19 \n\npicocontainer:\n\n- Install missing LICENSE.txt file (bsc#1114814) \n\npython-susemanager-retail:\n\n- Improve error reporting on duplicate systems\n- Output partition size as int (bsc#1116517)\n- Start partition numbers from 1\n- Warn on long group names\n- Improved logging support\n- Add retail_yaml --only-new option\n- Print import summary (bsc#1112754)\n- Add retail_migration tool\n- Check for duplicate addresses in yaml (bsc#1111497)\n\nsalt-netapi-client:\n\n- Version 0.15.0\n  See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.15.0\n\nsaltboot-formula:\n\n- Send pxe_update by external command to make sure it is finished\n  (bsc#1111387)\n- Better error message on missing partitioning pillar (bsc#1110625)\n\nspacecmd:\n\n- Show group id on group_details (bsc#1111542)\n- State channels handling: Existing commands configchannel_create and configchannel_import were updated\n  while system_scheduleapplyconfigchannels and configchannel_updateinitsls were added.\n\nspacewalk-branding:\n\n- Automatic cleanup of notification messages after a configurable lifetime\n- ActivationKey base and child channel in a reactjs component\n- New messages are added for XMLRPC API for state channels\n\nspacewalk-config:\n\n- Add permissions for tomcat \u0026 apache to check bootstrap ssh file (bsc#1114181)\n\nspacewalk-java:\n\n- Improve return value and errors thrown for system.createEmptyProfile XMLRPC endpoint\n- Fix scheduling jobs to prevent forever pending events (bsc#1114991)\n- Performance improvements for group listings and detail page (bsc#1111810)\n- Fix wrong counts of systems currency reports when a system belongs to more than one group (bsc#1114362)\n- Add check if ssh-file permissions are correct (bsc#1114181)\n- Increase maximum number of threads and open files for taskomatic (bsc#1111966)\n- When removing cobbler system record, lookup by mac address as well if lookup by id fails(bsc#1110361)\n- Allow listing empty system profiles via XMLRPC\n- Automatic cleanup of notification messages after a configurable lifetime\n- Different methods have been refactored in tomcat/taskomatic for better performance(bsc#1106430)\n- Do not try cleanup when deleting empty system profiles (bsc#1111247)\n- Better error handling when a websocket connection is aborted (bsc#1080474)\n- Change Requires to allow installing with both Tomcat 8 (SLE-12SP3) and 9 (SLE12-SP4)\n- ActivationKey base and child channel in a reactjs component\n- Fix typo in messages (bsc#1111249)\n- Cleanup formula data and assignment when migrating formulas or when removing system\n- Remove restrictions on SUSE Manager Channel subscriptions (bsc#1105724)\n- Added shortcut for editing Software Channel\n- Fix permissions check on formula list api call (bsc#1106626)\n- Add sp migration dry runs to the daily status report (bsc#1083094)\n\nspacewalk-search:\n\n- Fix nutch-core path (bsc#1112445)\n\nspacewalk-setup:\n\n- Increase maximum number of threads and open files for taskomatic (bsc#1111966)\n\nspacewalk-utils:\n\n- Fix typo at --phases option help\n\nspacewalk-web:\n\n- Make datetimepicker update displayed time (bsc#1041999)\n- Show human-readable system cleanup error messages\n- ActivationKey base and child channel in a reactjs component\n- Fix typo in messages (bsc#1111249)\n\nsusemanager:\n\n- Add new option --with-parent-channel to mgr-create-bootrap-repo\n  to specify parent channel to use if multiple options are available\n  (bsc#1104487)\n\nsusemanager-docs_en:\n\n- Update text and image files.\n- Add information about SLE12 SP4 as base OS for Server and Proxy\n\nsusemanager-frontend-libs:\n\n- Fix package version (bsc#1115449)\n\nsusemanager-schema:\n\n- Automatic cleanup of notification messages after a configurable lifetime\n- Add missing minion-action-chain-cleanup to db init scripts\n\nsusemanager-sls:\n\n- Deploy SSL certificate during onboarding of openSUSE Leap 15.0 (bsc#1112163)\n\nsusemanager-sync-data:\n\n- SUSE OpenStack Cloud 9 enablement (bsc#1113557)\n- Add SUSE Manager 3.1 and 3.2 to SLES12 SP4\n\ntika-core:\n\n- Fix improper XML parsing to prevent DoS attacks (CVE-2018-11761) (bsc#1109235)\n- Install missing LICENSE.txt file (bsc#1114814)\n- New upstream version (0.19.1) \n\n","status":"published","published":"2018-12-07T12:25:18Z","modified":"2026-02-04T02:31:22.642921Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}