CVE-2020-9489: Apache Tika - Missing Release of Memory after Effective Lifetime
Summary
CVE-2020-9489: Missing Release of Memory after Effective Lifetime in Apache Tika. Affects org.apache.tika:tika versions < 1.24.1. Fixed in 1.24.1. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2020-9489 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tika is an open-source content analysis toolkit that is used for detecting and extracting metadata and structured text content from various file formats. It provides support for parsing a wide range of file types, including documents, images, audio files, and more. This vulnerability affects the Apache Tika library versions prior to 1.24.1.
Vulnerability Detail
The vulnerability in Apache Tika arises from a failure to release memory after its effective lifetime. This can be exploited by an attacker through a carefully crafted or corrupt file, leading to various consequences. In the OneNote Parser, such a file can trigger a System.exit, causing the application to terminate unexpectedly. Additionally, crafted or corrupted files can cause out of memory errors and/or infinite loops in several other parsers, including ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser, and ImageParser. These vulnerabilities can potentially be leveraged by an attacker to disrupt the availability of the affected application or cause it to consume excessive system resources.
How To Fix
Minimum fixed version
1.24.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Apache Tika to ensure the proper mitigation of the issue.
Conclusion
The vulnerability in Apache Tika, CVE-2020-9489, poses a moderate risk to applications utilizing the affected versions. Upgrading to Apache Tika 1.24.1 or later is crucial to mitigate the memory release issue and prevent potential exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika →
FAQ
Apache Tika is an open-source content analysis toolkit used for extracting metadata and structured text content from various file formats.
This vulnerability can lead to unexpected termination of the application, out of memory errors, and infinite loops, potentially causing denial of service or excessive resource consumption.
The vulnerability affects the ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser, and ImageParser in Apache Tika.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
To fix this vulnerability, upgrade to Apache Tika version 1.24.1 or later, which includes the necessary patches to address the issue.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika.
