GitHub Advisoryadvisory · Maven

GHSA-j8g6-2wh7-6439 Apache Tika allows Java code execution for serialized objects embedded in MATLAB files

CRITICAL Published 2018-10-17 Modified 2024-04-12 Official page ↗
Aliases
CVE-2016-6809
Ecosystem
Maven
Packages
org.apache.tika:tika-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2020-06-16

Affected packages

• Maven org.apache.tika:tika-core: < 1.14 → fixed in 1.14

Description

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.

Related

Alias · CVE (1)

  • CVE-2016-6809 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References