Infinite loop in Apache Tika's MP3 parser
CVE-2021-28657

5.5MEDIUM

Key Information:

Vendor
Apache
Status
Apache Tika
Vendor
CVE Published:
31 March 2021

Summary

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Affected Version(s)

Apache Tika Apache Tika < 1.26

References

https://lists.apache.org/thread.html/r915add4aa52c60d1b5c...
x_refsource_MISC
https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482...
mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpuoct2021.html
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Tika would like to thank Khaled Nassar for reporting this issue.
.