Vulnerabilities > CVE-2021-28657 - Infinite Loop vulnerability in multiple products

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

local

low complexity

apache

oracle

CWE-835

NVD

Published: 2021-03-31

Updated: 2024-11-21

Summary

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Tika 0.1 Apache Tika 0.2 Apache Tika 0.3 Apache Tika 0.4 Apache Tika 0.5 Apache Tika 0.6 Apache Tika 0.7 Apache Tika 0.8 Apache Tika 0.9 Apache Tika 0.10 Apache Tika 1.0 Apache Tika 1.1 Apache Tika 1.2 Apache Tika 1.3 Apache Tika 1.4 Apache Tika 1.5 Apache Tika 1.6 Apache Tika 1.7 Apache Tika 1.8 Apache Tika 1.9 Apache Tika 1.10 Apache Tika 1.11 Apache Tika 1.12 Apache Tika 1.13 Apache Tika 1.14 Apache Tika 1.15 Apache Tika 1.16 Apache Tika 1.17 Apache Tika 1.18 Apache Tika 1.19 Apache Tika 1.19.1 Apache Tika 1.20 Apache Tika 1.21 Apache Tika 1.22 Apache Tika 1.23 Apache Tika 1.24 Apache Tika 1.24.1 Apache Tika 1.25	38
Application	Oracle Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 12.2.1.4.0 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier 17.7 Oracle Primavera Unifier 17.8 Oracle Primavera Unifier 17.9 Oracle Primavera Unifier 17.10 Oracle Primavera Unifier 17.11 Oracle Primavera Unifier 17.12 Oracle Primavera Unifier 19.12 Oracle Primavera Unifier 20.12 Oracle Healthcare Foundation 7.3.0 Oracle Healthcare Foundation 8.0.0 Oracle Healthcare Foundation 8.1.0	14
OS	Oracle Oracle Communications Messaging Server 8.1	1

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References