security scanner on RHEL turned up a breaking change requirement?

[robipete]

FYI So company 'A' requires a security scan. one thing it turned up on our norconex crawler servers was about the poi jars being vulnerabilities and following the recommendations partially breaks norconex 3.0.2 . So when we upgrade the below jars ie it appears to break parsing MS type docs. We put these fixes in to the lib dir and got 30 docs back from the crawl where reverting to the 4.1.2 versions of all three gets us the full complement of 247 crawled docs indexed into solr as before the upgrade fixes (so is this a know issue fixed in 3.1? maybe? We're crawling a sharepoint public website full of MS files and other stuff) :

Apache POI < 5.4.0 Improper Input Validation

Misc.

Medium

Plugin Output:
Path : /opt/norconex-collector-http-3.0.2/lib/poi-scratchpad-4.1.2.jar
Installed version : 4.1.2
Fixed version : 5.4.0

Path : /opt/norconex-collector-http-3.0.2/lib/poi-ooxml-4.1.2.jar
Installed version : 4.1.2
Fixed version : 5.4.0

Path : /opt/norconex-collector-http-3.0.2/lib/poi-4.1.2.jar
Installed version : 4.1.2
Fixed version : 5.4.0

• Updating POI jars mostly breaks the crawler

[essiembre]

The version of Apache Tika (1.x) used by the crawler v3.x is dependent on POI version 4.x. Apacke Tika 2.x uses POI version 5.x. Apache Tika 2.x (or higher) will be used in version 4 of the crawler when released. For version 3.x of the crawler, I am marking upgrading Apacke Tika to version 2.x this as a feature request.

[artur-szkopek]

Apache Tika 1.x used by the current crawler version contains many vulnerabilities including two critical ones: CVE-2025-54988 and CVE-2025-66516 which makes the crawler unusable for any company that cares about security.

@essiembre
Is there any estimated release date for the version 4.x? (based on tika 3.x, I presume)
Also, any plans to mitigate these vulnerabilities in the 3.x line?

[essiembre]

Given the delays in releasing version 4.x of the crawler, we will assess the feasibility of upgrading Tika to v3 in the meantime. This will likely require upgrading the minimum Java version to 17, which should be acceptable for most users running v3 today. Help testing snapshot release(s) would be greatly appreciated.

[essiembre]

Version 3.2.0-SNAPSHOT was just released with Tika 3.x. Please test and report any issues.