CVE-2020-9489: Medium severity Apache Tika vulnerability
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9489 http://seclists.org/oss-sec/2020/q2/69 https://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3E
Other sources
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-9489?
CVE-2020-9489 is a vulnerability in Apache Tika that allows a carefully crafted or corrupt file to trigger a System.exit in Tika's OneNote Parser, causing the application to exit unexpectedly.
What software versions are affected by CVE-2020-9489?
CVE-2020-9489 affects Apache Tika versions 1.24, Oracle FLEXCUBE Private Banking versions 12.0.0 and 12.1.0, Oracle Primavera Unifier versions 16.1, 16.2, 18.8, and 19.12, Oracle WebCenter Portal versions 12.2.1.3.0 and 12.2.1.4.0, and Oracle Communications Messaging Server version 8.1.
How severe is CVE-2020-9489?
CVE-2020-9489 has a severity rating of 5.5 out of 10, which is categorized as medium severity.
How can I fix CVE-2020-9489?
To fix CVE-2020-9489, Apache Tika users should upgrade to the latest version available.
What can a carefully crafted or corrupt file trigger in Tika's OneNote Parser?
A carefully crafted or corrupt file can trigger a System.exit in Tika's OneNote Parser, causing the application to exit.