Advisories for Maven/Org.apache.tika/Tika-App package

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser.

In a rare edge case where a user does not specify an extract directory on the commandline (–extract-dir=) and the input file has an embedded file with an absolute path, tika-app would overwrite that file.