GHSA-567x-m4wm-87v8

Infinite loop in Apache Tika

En bref

Publiée: 2021-05-10 15:23 UTC
Mise à jour: 2024-02-17 05:34 UTC
CVE: CVE-2021-28657
CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Description

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Paquets affectés

Paquet	Versions
Maven · org.apache.tika:tika	introduced 0, fixed 1.26

Références

https://nvd.nist.gov/vuln/detail/CVE-2021-28657 ADVISORY
https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b@%3Cnotifications.james.apache.org%3E WEB
https://lists.apache.org/thread.html/r915add4aa52c60d1b5cf085039cfa73a98d7fae9673374dfd7744b5a%40%3Cdev.tika.apache.org%3E WEB
https://security.netapp.com/advisory/ntap-20210507-0004 WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
https://www.oracle.com/security-alerts/cpuoct2021.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database