Bug 1256846 (CVE-2015-3271)

Summary:	CVE-2015-3271 tika: Information disclosure vulnerability when running Apache Tika Server
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	java-sig-commits, puntogil
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-09-19 09:35:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1256847
Bug Blocks:

Description Adam Mariš 2015-08-25 15:07:24 UTC

Apache Tika provides optional functionality to run itself as a web service to allow remote use. When used in this 
manner, it's possible for a 3rd party to pass a 'fileUrl' header to the Apache Tika Server (tika-server).
This header lets a remote client request that the server fetches content from the URL provided, including files
from the server's local filesystem.
Depending on the file permissions set on the local filesystem, this could be used to return sensitive content from 
the server machine.

This vulnerability only exists if you are running the tika-server version 1.9, and you allow un-trusted access
to the tika-server URL. Usage of Apache Tika as a standard library is not affected.

Mitigation:
Apache Tika 1.9 users should upgrade to Apache Tika 1.10

Reference:

http://seclists.org/oss-sec/2015/q3/350

Comment 1 Adam Mariš 2015-08-25 15:07:53 UTC

Created tika tracking bugs for this issue:

Affects: fedora-all [bug 1256847]

Comment 2 gil cattaneo 2015-08-25 15:28:14 UTC

Tika package do not provides server module. This bug is invalid