https://bugzilla.redhat.com/show_bug.cgi?id=1256846
Bug ID: 1256846
Summary: CVE-2015-3271 tika: Information disclosure
vulnerability when running Apache Tika Server
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Apache Tika provides optional functionality to run itself as a web service to
allow remote use. When used in this
manner, it's possible for a 3rd party to pass a 'fileUrl' header to the
Apache
Tika Server (tika-server).
This header lets a remote client request that the server fetches content from
the URL provided, including files
from the server's local filesystem.
Depending on the file permissions set on the local filesystem, this could be
used to return sensitive content from
the server machine.
This vulnerability only exists if you are running the tika-server version 1.9,
and you allow un-trusted access
to the tika-server URL. Usage of Apache Tika as a standard library is not
affected.
Mitigation:
Apache Tika 1.9 users should upgrade to Apache Tika 1.10
Reference:
http://seclists.org/oss-sec/2015/q3/350
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=xPLyyXltSK&a=cc_unsubscribe
_______________________________________________
java-sig-commits mailing list
java-sig-commits(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedorapro...