Vulnerability · Published Mar 23, 2020 · Assigned by apache
CVE-2020-1951
Medium 5.5
In plain English
A medium-severity security flaw in Apache Tika. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)2.9%top 13.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.tika:tika | 1.24 | GHSA-3264-3fm9-fg44 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Tika | Apache Tika 1.0-1.23 |
References
- [debian-lts-announce] 20200328 [SECURITY] [DLA 2161-1] tika security update mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
- https://lists.apache.org/thread.html/rd8c1b42bd0e31870d804890b3f00b13d837c528f7ebaf77031323172%40%3Cdev.tika.apache.org%3E x_refsource_MISC
- USN-4564-1 vendor-advisory, x_refsource_UBUNTU
- https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC