Infinite loop in Apache Tika - CVE-2020-1951
Published: March 31, 2020
Vulnerability identifier: #VU26470
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-1951
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in "PSDParser". A remote attacker can use a specially crafted PSD file, consume all available system resources and cause denial of service conditions.
Affected software
Apache Tika
Oracle Communications Instant Messaging Server
Oracle FLEXCUBE Private Banking
Oracle Business Process Management Suite
Ubuntu
libtika-java (Ubuntu package)
tika (Ubuntu package)
Oracle Communications Instant Messaging Server
Oracle FLEXCUBE Private Banking
Oracle Business Process Management Suite
Ubuntu
libtika-java (Ubuntu package)
tika (Ubuntu package)
How to mitigate CVE-2020-1951
Install updates from vendor's website.
Apache Tika - update to 1.24
libtika-java (Ubuntu package) - update to 1.5-4ubuntu0.1
tika (Ubuntu package) - addressed in versions 1.22-1ubuntu0.1~esm1, 1.22-2ubuntu0.22.04.1~esm1
libtika-java (Ubuntu package) - update to 1.5-4ubuntu0.1
tika (Ubuntu package) - addressed in versions 1.22-1ubuntu0.1~esm1, 1.22-2ubuntu0.22.04.1~esm1