Lucene search

ApacheCVE-2020-9489

HistoryApr 27, 2020 - 2:15 p.m.

CVE-2020-9489

2020-04-2714:15:11

CWE-835

apache

web.nvd.nist.gov

cve-2020-9489

apache tika

onenote parser

icnsparser

mp3parser

mp4parser

sas7bdatparser

imageparser

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

A carefully crafted or corrupt file may trigger a System.exit in Tika’s OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika’s ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

Affected configurations

Nvd

Vulners

Node

apachetikaMatch1.24

Node

oracleflexcube_private_bankingMatch12.0.0

oracleflexcube_private_bankingMatch12.1.0

oracleprimavera_unifierRange17.7–17.12

oracleprimavera_unifierMatch16.1

oracleprimavera_unifierMatch16.2

oracleprimavera_unifierMatch18.8

oracleprimavera_unifierMatch19.12

oraclewebcenter_portalMatch12.2.1.3.0

oraclewebcenter_portalMatch12.2.1.4.0

oraclecommunications_messaging_serverMatch8.1

VendorProductVersionCPE
apachetika1.24cpe:2.3:a:apache:tika:1.24:*:*:*:*:*:*:*
oracleflexcube_private_banking12.0.0cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
oracleflexcube_private_banking12.1.0cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
oracleprimavera_unifier*cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
oracleprimavera_unifier16.1cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
oracleprimavera_unifier16.2cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
oracleprimavera_unifier18.8cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
oracleprimavera_unifier19.12cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
oraclewebcenter_portal12.2.1.3.0cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
oraclewebcenter_portal12.2.1.4.0cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	tika	1.24	cpe:2.3:a:apache:tika:1.24:::::::*
oracle	flexcube_private_banking	12.0.0	cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:::::::*
oracle	flexcube_private_banking	12.1.0	cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:::::::*
oracle	primavera_unifier	*	cpe:2.3:a:oracle:primavera_unifier::::::::
oracle	primavera_unifier	16.1	cpe:2.3:a:oracle:primavera_unifier:16.1:::::::*
oracle	primavera_unifier	16.2	cpe:2.3:a:oracle:primavera_unifier:16.2:::::::*
oracle	primavera_unifier	18.8	cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*
oracle	primavera_unifier	19.12	cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*
oracle	webcenter_portal	12.2.1.3.0	cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:::::::*
oracle	webcenter_portal	12.2.1.4.0	cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:::::::*

Rows per page:

1-10 of 111

CNA Affected

[
  {
    "product": "Apache Tika",
    "vendor": "The Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Up to 1.24"
      }
    ]
  }
]