CVE-2016-6809: Critical severity apache nutch vulnerability
Published Apr 6, 2017
·Updated
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Affected Software
3 affected componentsFixes available
Apache Nutch=2.3.1
Apache Tika<=1.13
maven/org.apache.tika:tika-core<1.14
1.14
Event History
Apr 6, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Oct 17, 2018
Advisory Published
via GitHub·03:44 PM
Frequently Asked Questions
1
What is the severity of CVE-2016-6809?
CVE-2016-6809 has been assessed as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2016-6809?
To fix CVE-2016-6809, upgrade to Apache Tika version 1.14 or later.
3
Which versions of Apache Tika are affected by CVE-2016-6809?
CVE-2016-6809 affects all versions of Apache Tika prior to version 1.14.
4
Can CVE-2016-6809 lead to unauthorized access?
Yes, CVE-2016-6809 can allow an attacker to execute arbitrary Java code remotely, leading to unauthorized access.
5
What software uses Apache Tika and is vulnerable to CVE-2016-6809?
Apache Nutch version 2.3.1 and earlier versions of Apache Tika are vulnerable to CVE-2016-6809.