CVE-2020-9489
published 2020-04-27CVE-2020-9489: A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or…
PriorityP423medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
2.55%
83.3th percentile
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tika | — | — |
| apache | tika | — | — |
| debian | tika | — | — |
| oracle | communications_messaging_server | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | 17.7 – 17.12 | — |
| oracle | webcenter_portal | — | — |
| oracle | webcenter_portal | — | — |
| the_apache_software_foundation | apache_tika | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_apache5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_oracle5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing Release of Memory after Effective Lifetime in Apache Tika
ghsa·2021-05-07
CVE-2020-9489 [MEDIUM] CWE-401 Missing Release of Memory after Effective Lifetime in Apache Tika
Missing Release of Memory after Effective Lifetime in Apache Tika
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
OSV
Missing Release of Memory after Effective Lifetime in Apache Tika
osv·2021-05-07
CVE-2020-9489 [MEDIUM] Missing Release of Memory after Effective Lifetime in Apache Tika
Missing Release of Memory after Effective Lifetime in Apache Tika
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
OSV
CVE-2020-9489: A carefully crafted or corrupt file may trigger a System
osv·2020-04-27·CVSS 5.5
CVE-2020-9489 [MEDIUM] CVE-2020-9489: A carefully crafted or corrupt file may trigger a System
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Apache Tika) — CVE-2020-9489
vendor_oracle·2021-04-15·CVSS 5.5
CVE-2020-9489 [MEDIUM] Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Apache Tika) — CVE-2020-9489
Oracle Oracle Financial Services Applications Risk Matrix: Financial Planning (Apache Tika) vulnerability
CVE: CVE-2020-9489
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2021 (APR 2021)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Tika) — CVE-2020-9489
vendor_oracle·2020-10-15·CVSS 5.5
CVE-2020-9489 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Core (Apache Tika) — CVE-2020-9489
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Tika) vulnerability
CVE: CVE-2020-9489
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuoct2020 (OCT 2020)
Red Hat
tika-core: Denial of Service Vulnerabilities in Some of Apache Tika's Parsers
vendor_redhat·2020-04-24·CVSS 5.5
CVE-2020-9489 [MEDIUM] CWE-401 tika-core: Denial of Service Vulnerabilities in Some of Apache Tika's Parsers
tika-core: Denial of Service Vulnerabilities in Some of Apache Tika's Parsers
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Package: tika-core (Red Hat JBoss BRMS 5) - Out of support scope
Package: tika-core (Red Hat JBoss BRMS 6) - Out of support scope
Package: tika-core
Debian
CVE-2020-9489: tika - A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote ...
vendor_debian·2020·CVSS 5.5
CVE-2020-9489 [MEDIUM] CVE-2020-9489: tika - A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote ...
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Scope: local
bullseye: open
sid: open
Apache
Apache tika: CVE-2020-9489
vendor_apache·CVSS 5.5
CVE-2020-9489 [MEDIUM] Apache tika: CVE-2020-9489
Apache tika: CVE-2020-9489
System.exit vulnerability in Tika's OneNote Parser; out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Tim Allison 1.0-1.24
No detection rules found.
No public exploits indexed.
https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3Ehttps://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3Ehttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3Ehttps://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3Ehttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.html
2020-04-27
Published