apache-tika-3.1.advisories.yaml

schema-version: 2.0.2

package:
  name: apache-tika-3.1

advisories:
  - id: CGA-276w-r2rj-4c6m
    aliases:
      - CVE-2024-6763
      - GHSA-qh8g-58pp-2wxh
    events:
      - timestamp: 2025-02-26T07:08:33Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-tika-3.1
            componentID: 8212eb65559c4603
            componentName: jetty-http
            componentVersion: 11.0.24
            componentType: java-archive
            componentLocation: /usr/share/java/tika-server-standard-3.1.0.jar
            scanner: grype
      - timestamp: 2025-02-26T16:32:20Z
        type: fixed
        data:
          fixed-version: 3.1.0-r1
      - timestamp: 2025-03-08T13:11:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-tika-3.1
            componentID: 8212eb65559c4603
            componentName: jetty-http
            componentVersion: 11.0.24
            componentType: java-archive
            componentLocation: /usr/share/java/tika-server-standard-3.1.0.jar
            scanner: grype
      - timestamp: 2025-03-11T17:06:52Z
        type: pending-upstream-fix
        data:
          note: |
            "The upstream project has to fix the issue since if we attempt to bump the jetty-http version from '11.0.24' to the fixed version '12.0.12' the project fails at compilation due to error 'Exception in thread "main" java.lang.NoSuchMethodError: 'int org.eclipse.jetty.util.URIUtil.getDefaultPortForScheme(java.lang.String)'"