Bug 1850042 (CVE-2020-9489) - CVE-2020-9489 tika-core: Denial of Service Vulnerabilities in Some of Apache Tika's Parsers
Summary: CVE-2020-9489 tika-core: Denial of Service Vulnerabilities in Some of Apache ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-9489
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1850043
TreeView+ depends on / blocked
 
Reported: 2020-06-23 13:01 UTC by Michael Kaplan
Modified: 2020-12-16 16:19 UTC (History)
32 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-12-16 16:19:04 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:5568 0 None None None 2020-12-16 12:14:25 UTC

Description Michael Kaplan 2020-06-23 13:01:35 UTC 
A carefully crafted or corrupt file may trigger a System.exit in Tika's
OneNote Parser. Crafted or corrupted files can also cause out of memory
errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser,
SAS7BDATParser, OneNoteParser and ImageParser.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9489
http://seclists.org/oss-sec/2020/q2/69
https://lists.apache.org/thread.html/r4d943777e36ca3aa6305a45da5acccc54ad894f2d5a07186cfa2442c%40%3Cdev.tika.apache.org%3E
Comment 1 Paramvir jindal 2020-06-24 05:51:41 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss BRMS 6
 * Red Hat JBoss BRMS 5
 * Red Hat JBoss Data Virtualization & Services 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details."
Comment 2 Kunjan Rathod 2020-06-25 00:20:38 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse Service Works(FWS) 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details."
Comment 4 errata-xmlrpc 2020-12-16 12:14:18 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.8.0

Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568
Comment 5 Product Security DevOps Team 2020-12-16 16:19:04 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-9489
Note You need to log in before you can comment on or make changes to this bug.