Skip to content
OpenAdvisories
Medium · 5.5 CVE-2021-28657 EUVD-2021-0949GHSA-567x-m4wm-87v8

Infinite loop in Apache Tika's MP3 parser

Published Mar 31, 2021 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tika Package: org.apache.tika:tika Package: tika Package: tika Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tika Apache Tika – < 1.26 1.26

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 11 tika No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tika No fix yet —
Ubuntu 26.04 LTS tika No fix yet —
Ubuntu 25.10 tika No fix yet —
Ubuntu 24.04 LTS tika No fix yet —
Ubuntu 18.04 LTS tika No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS tika No fix yet —
Ubuntu Pro 22.04 LTS tika No fix yet —
Ubuntu Pro 20.04 LTS tika No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.1 cobbler 3.0.0+git20190806.32c4bae0-5.11.1 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 golang-github-prometheus-node_exporter 1.1.2-3.6.5 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 grafana-formula 0.4.1-3.9.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 patterns-suse-manager 4.1-6.9.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 prometheus-exporters-formula 0.9.1-3.22.1 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 py26-compat-salt 2016.11.10-6.14.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 py27-compat-salt 3000.3-6.3.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 spacewalk-admin 4.1.9-3.12.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 spacewalk-backend 4.1.25-4.32.6 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 spacewalk-branding 4.1.12-3.12.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 spacewalk-certs-tools 4.1.17-3.17.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 spacewalk-java 4.1.36-3.44.1 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 spacewalk-utils 4.1.16-3.18.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 spacewalk-web 4.1.26-3.24.8 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 susemanager 4.1.26-3.25.1 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 susemanager-build-keys 15.2.4-3.17.1 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 susemanager-doc-indexes 4.1-11.34.8 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 susemanager-docs_en 4.1-11.34.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 susemanager-schema 4.1.21-3.30.6 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 susemanager-sls 4.1.28-3.42.1 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 susemanager-sync-data 4.1.14-3.23.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 tika-core 1.26-3.5.2 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.1 uyuni-common-libs 4.1.8-3.9.1 SUSE-SU-2021:2098-1
SUSE Manager Server Module 4.0 cobbler 3.0.0+git20190806.32c4bae0-7.22.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 grafana-formula 0.2.3-4.16.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 patterns-suse-manager 4.0-9.19.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 prometheus-exporters-formula 0.7.6-3.19.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 pxe-default-image-sle15 4.0.1-20210621145802 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 py26-compat-salt 2016.11.10-10.28.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 py27-compat-salt 3000.3-4.3.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 spacewalk-backend 4.0.38-3.47.4 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 spacewalk-java 4.0.44-3.57.5 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 spacewalk-utils 4.0.21-3.30.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 spacewalk-web 4.0.28-3.45.1 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 susemanager 4.0.34-3.52.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 susemanager-doc-indexes 4.0-10.36.4 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 susemanager-docs_en 4.0-10.36.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 susemanager-sls 4.0.35-3.48.3 SUSE-SU-2021:2114-1
SUSE Manager Server Module 4.0 tika-core 1.26-3.6.3 SUSE-SU-2021:2114-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tika:tika < 1.26 1.26 GHSA-567x-m4wm-87v8

Advisories 4

References