Description
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | tika | 1.18-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tika:tika-core | < 1.14 | 1.14 | GHSA-j8g6-2wh7-6439 |
References
- 94247 vdb-entry
- https://dist.apache.org/repos/dist/release/tika/CHANGES-1.14.txt
- http://seclists.org/bugtraq/2016/Nov/40
- [lucene-dev] 20190325 Re: 6.6.6 Release mailing-list
- [nutch-dev] 20191014 [SECURITY] Nutch 2.3.1 affected by downstream dependency CVE-2016-6809 mailing-list
- [nutch-user] 20191014 [SECURITY] Nutch 2.3.1 affected by downstream dependency CVE-2016-6809 mailing-list
- [lucene-issues] 20200815 [jira] [Commented] (SOLR-11486) CVE-2016-6809: Upgrade TIKA mailing-list
- [lucene-issues] 20200816 [jira] [Issue Comment Deleted] (SOLR-11486) CVE-2016-6809: Upgrade TIKA mailing-list