CVE-2020-9489
First published: Fri Apr 24 2020(Updated: )
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9489">http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9489</a> <a href="http://seclists.org/oss-sec/2020/q2/69">http://seclists.org/oss-sec/2020/q2/69</a> <a href="https://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3E">https://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3E</a>
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Tika | =1.24 | |
| Oracle FLEXCUBE Private Banking | =12.0.0 | |
| Oracle FLEXCUBE Private Banking | =12.1.0 | |
| Oracle Primavera Unifier | >=17.7<=17.12 | |
| Oracle Primavera Unifier | =16.1 | |
| Oracle Primavera Unifier | =16.2 | |
| Oracle Primavera Unifier | =18.8 | |
| Oracle Primavera Unifier | =19.12 | |
| Oracle WebCenter Portal | =12.2.1.3.0 | |
| Oracle WebCenter Portal | =12.2.1.4.0 | |
| Sun iPlanet Messaging Server | =8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-9489 https://nvd.nist.gov/vuln/detail/CVE-2020-9489
- https://bugzilla.redhat.com/show_bug.cgi?id=1850042
- https://access.redhat.com/errata/RHSA-2020:5568
- https://access.redhat.com/security/cve/cve-2020-9489
- https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b@%3Cnotifications.james.apache.org%3E
- https://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3E
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9489
- http://seclists.org/oss-sec/2020/q2/69
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E
Frequently Asked Questions
What is CVE-2020-9489?
CVE-2020-9489 is a vulnerability in Apache Tika that allows a carefully crafted or corrupt file to trigger a System.exit in Tika's OneNote Parser, causing the application to exit unexpectedly.
What software versions are affected by CVE-2020-9489?
CVE-2020-9489 affects Apache Tika versions 1.24, Oracle FLEXCUBE Private Banking versions 12.0.0 and 12.1.0, Oracle Primavera Unifier versions 16.1, 16.2, 18.8, and 19.12, Oracle WebCenter Portal versions 12.2.1.3.0 and 12.2.1.4.0, and Oracle Communications Messaging Server version 8.1.
How severe is CVE-2020-9489?
CVE-2020-9489 has a severity rating of 5.5 out of 10, which is categorized as medium severity.
How can I fix CVE-2020-9489?
To fix CVE-2020-9489, Apache Tika users should upgrade to the latest version available.
What can a carefully crafted or corrupt file trigger in Tika's OneNote Parser?
A carefully crafted or corrupt file can trigger a System.exit in Tika's OneNote Parser, causing the application to exit.
- collector/redhat-cve
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-9489
- agent/remedy
- agent/severity
- agent/author
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache tika
- version/apache tika/1.24
- vendor/oracle
- canonical/oracle flexcube private banking
- version/oracle flexcube private banking/12.0.0
- version/oracle flexcube private banking/12.1.0
- canonical/oracle primavera unifier
- version/oracle primavera unifier/17.7
- version/oracle primavera unifier/17.12
- version/oracle primavera unifier/16.1
- version/oracle primavera unifier/16.2
- version/oracle primavera unifier/18.8
- version/oracle primavera unifier/19.12
- canonical/oracle webcenter portal
- version/oracle webcenter portal/12.2.1.3.0
- version/oracle webcenter portal/12.2.1.4.0
- canonical/sun iplanet messaging server
- version/sun iplanet messaging server/8.1