CVE-2020-9489
Description
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
How to fix
- org.apache.tika:tika1.24.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tika | 1.24 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 16.1, 16.2, 18.8, 19.12 | — |
| oracle webcenter_portal | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_messaging_server | 8.1 | — |
| org.apache.tika:tikaMaven | v < 1.24.1 | 1.24.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.