CVE-2021-28657

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Score

CVSS 3.1 5.5 Medium

Status

Modified - security@apache.org

Published

2021-03-31

Last modified

2025-02-13

Weaknesses

CWE-835

Affected products

• Tika (Apache)
• Apache Tika (Apache Software Foundation)
• Communications Messaging Server (Oracle)
• Healthcare Foundation (Oracle)
• Primavera Unifier (Oracle)
• Webcenter Portal (Oracle)

References

• https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james…
• https://lists.apache.org/thread.html/r915add4aa52c60d1b5cf085039cfa73a98d7fae9673374dfd7744b5a%40%3Cdev.tika.apache.org…
• https://security.netapp.com/advisory/ntap-20210507-0004/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html