GitHub Advisoryadvisory · Maven

GHSA-4pv3-63jw-4jw2 Missing Release of Memory after Effective Lifetime in Apache Tika

MEDIUM Published 2021-05-07 Modified 2022-10-07 Official page ↗
Aliases
CVE-2020-9489
Ecosystem
Maven
Packages
org.apache.tika:tika
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-401, CWE-835
Reviewed
2021-05-05

Affected packages

• Maven org.apache.tika:tika: < 1.24.1 → fixed in 1.24.1

Description

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

Related

Alias · CVE (1)

  • CVE-2020-9489 A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. vulnerability

Weakness · CWE (2)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References