Log in Start free

Vulnerability · Published Apr 27, 2020 · Assigned by apache

CVE-2020-9489

Medium 5.5

In plain English

A medium-severity security flaw in Apache Tika from The Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)2.7%top 14.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.tika:tika1.24.1GHSA-4pv3-63jw-4jw2
Ubuntu:25.10tikano fix listedUBUNTU-CVE-2020-9489
Ubuntu:26.04:LTStikano fix listedUBUNTU-CVE-2020-9489
Ubuntu:26.10tikano fix listedUBUNTU-CVE-2020-9489

Affected products (as reported)

VendorProductVersions
The Apache Software Foundation Apache Tika Up to 1.24

References