Infinite loop in Apache Tika - CVE-2021-28657

Vulnerability identifier: #VU51796

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-28657

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within MP3Parser component. A remote attacker can suply a specially crafted file, consume all available system resources and cause denial of service conditions.

Apache Tika
SUSE Linux Enterprise Module for SUSE Manager Server
IBM Qradar SIEM
Oracle Communications Instant Messaging Server
Oracle WebCenter Portal
Primavera Unifier
grafana-formula
prometheus-exporters-formula
golang-github-prometheus-node_exporter
tika-core
pxe-default-image-sle15
patterns-suma_retail
patterns-suma_server
susemanager-docs_en-pdf
susemanager-docs_en
susemanager-doc-indexes
spacewalk-utils
spacewalk-base-minimal-config
spacewalk-base-minimal
susemanager-web-libs
spacewalk-base
spacewalk-html
susemanager-tools
susemanager
susemanager-sls
python3-spacewalk-backend-libs
spacewalk-backend-tools
spacewalk-backend
spacewalk-backend-app
spacewalk-backend-applet
spacewalk-backend-config-files
spacewalk-backend-config-files-common
spacewalk-backend-config-files-tool
spacewalk-backend-iss
spacewalk-backend-package-push-server
spacewalk-backend-server
spacewalk-backend-sql
spacewalk-backend-sql-postgresql
spacewalk-backend-xml-export-libs
spacewalk-backend-xmlrpc
spacewalk-backend-iss-export
spacewalk-java-lib
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
spacewalk-java
python3-uyuni-common-libs
spacewalk-admin
spacewalk-branding
susemanager-sync-data
spacewalk-utils-extras
python3-spacewalk-certs-tools
spacewalk-certs-tools
susemanager-schema
uyuni-config-modules
susemanager-build-keys-web
susemanager-build-keys
py26-compat-salt
py27-compat-salt

Install updates from vendor's website.

Apache Tika - update to 1.26
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 9, 7.4.3 Fix Pack 1
grafana-formula - addressed in versions 0.2.3-4.16.3, 0.4.1-3.9.2
prometheus-exporters-formula - addressed in versions 0.7.6-3.19.3, 0.9.1-3.22.1
golang-github-prometheus-node_exporter - update to 1.1.2-3.6.5
tika-core - addressed in versions 1.26-3.5.2, 1.26-3.6.3
pxe-default-image-sle15 - update to 4.0.1-20210621145802
patterns-suma_retail - addressed in versions 4.0-9.19.3, 4.1-6.9.2
patterns-suma_server - addressed in versions 4.0-9.19.3, 4.1-6.9.2
susemanager-docs_en-pdf - addressed in versions 4.0-10.36.3, 4.1-11.34.2
susemanager-docs_en - addressed in versions 4.0-10.36.3, 4.1-11.34.2
susemanager-doc-indexes - addressed in versions 4.0-10.36.4, 4.1-11.34.8
spacewalk-utils - addressed in versions 4.0.21-3.30.3, 4.1.16-3.18.2
spacewalk-base-minimal-config - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
spacewalk-base-minimal - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
susemanager-web-libs - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
spacewalk-base - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
spacewalk-html - addressed in versions 4.0.28-3.45.1, 4.1.26-3.24.8
susemanager-tools - addressed in versions 4.0.34-3.52.3, 4.1.26-3.25.1
susemanager - addressed in versions 4.0.34-3.52.3, 4.1.26-3.25.1
susemanager-sls - addressed in versions 4.0.35-3.48.3, 4.1.28-3.42.1
python3-spacewalk-backend-libs - update to 4.0.38-3.47.4
spacewalk-backend-tools - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-app - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-applet - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-config-files - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-config-files-common - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-config-files-tool - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-iss - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-package-push-server - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-server - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-sql - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-sql-postgresql - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-xml-export-libs - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-xmlrpc - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-backend-iss-export - addressed in versions 4.0.38-3.47.4, 4.1.25-4.32.6
spacewalk-java-lib - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
spacewalk-taskomatic - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
spacewalk-java-postgresql - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
spacewalk-java-config - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
spacewalk-java - addressed in versions 4.0.44-3.57.5, 4.1.36-3.44.1
python3-uyuni-common-libs - update to 4.1.8-3.9.1
spacewalk-admin - update to 4.1.9-3.12.2
spacewalk-branding - update to 4.1.12-3.12.2
susemanager-sync-data - update to 4.1.14-3.23.2
spacewalk-utils-extras - update to 4.1.16-3.18.2
python3-spacewalk-certs-tools - update to 4.1.17-3.17.2
spacewalk-certs-tools - update to 4.1.17-3.17.2
susemanager-schema - update to 4.1.21-3.30.6
uyuni-config-modules - update to 4.1.28-3.42.1
susemanager-build-keys-web - update to 15.2.4-3.17.1
susemanager-build-keys - update to 15.2.4-3.17.1
py26-compat-salt - addressed in versions 2016.11.10-6.14.2, 2016.11.10-10.28.3
py27-compat-salt - addressed in versions 3000.3-4.3.3, 3000.3-6.3.2

• http://seclists.org/oss-sec/2021/q1/277

• Denial of service in Apache Tika
• Multiple vulnerabilities in Oracle WebCenter Portal
• SUSE update for SUSE Manager Server 4.1
• SUSE update for SUSE Manager Server 4.0
• Multiple vulnerabilities in Oracle Communications Messaging Server
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in IBM QRadar SIEM