GHSA-567x-m4wm-87v8

Infinite loop in Apache Tika

At a glance

Published: 2021-05-10 15:23 UTC
Updated: 2024-02-17 05:34 UTC
CVE: CVE-2021-28657
CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Description

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Affected packages

Package	Versions
Maven · org.apache.tika:tika	introduced 0, fixed 1.26

References

https://nvd.nist.gov/vuln/detail/CVE-2021-28657 ADVISORY
https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b@%3Cnotifications.james.apache.org%3E WEB
https://lists.apache.org/thread.html/r915add4aa52c60d1b5cf085039cfa73a98d7fae9673374dfd7744b5a%40%3Cdev.tika.apache.org%3E WEB
https://security.netapp.com/advisory/ntap-20210507-0004 WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
https://www.oracle.com/security-alerts/cpuoct2021.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database