{"id":"CVE-2021-28657","aliases":["DEBIAN-CVE-2021-28657","EUVD-2021-0949","GHSA-567x-m4wm-87v8","SUSE-SU-2021:2098-1","SUSE-SU-2021:2114-1","UBUNTU-CVE-2021-28657"],"status":"published","title":"Infinite loop in Apache Tika's MP3 parser","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02739,"percentile":0.86261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-835"],"published":"2021-03-31T07:35:14Z","modified":"2026-10-24T10:30:45Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tika:tika","fixed_in":["1.25","1.26"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tika:tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2","1.22-2+deb11u1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tika:tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26"}]}],"versions":["0.2","0.3","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.19.1","1.20","1.21","1.22","1.23","1.24","1.24.1","1.25","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-5.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3.6.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-3.9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-6.9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.14.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-6.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-3.12.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.25-4.32.6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.12-3.12.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.17-3.17.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.36-3.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-3.18.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.26-3.24.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.26-3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.4-3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.34.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.34.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-3.30.6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.28-3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14-3.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26-3.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-7.22.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.16.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.19.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.6-3.19.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"pxe-default-image-sle15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-20210621145802"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-10.28.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-4.3.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.38-3.47.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.44-3.57.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.21-3.30.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.28-3.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.34-3.52.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.36.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.36.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.35-3.48.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"tika-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26-3.6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-2","1.5-3","1.5-4","1.5-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1","1.22-1ubuntu0.1~esm1","1.22-1ubuntu0.1~esm2","1.22-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2","1.22-2ubuntu0.22.04.1~esm1","1.22-2+deb11u1build0.22.04.1","1.22-2+deb11u1ubuntu0.1~esm1","1.22-2+deb11u1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tika","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2"]}],"products":[{"vendor":"apache","product":"tika"},{"vendor":"apache software foundation","product":"apache tika"},{"vendor":"oracle","product":"communications_messaging_server"},{"vendor":"oracle","product":"healthcare_foundation"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"oracle","product":"webcenter_portal"}],"references":[{"url":"https://lists.apache.org/thread.html/r915add4aa52c60d1b5cf085039cfa73a98d7fae9673374dfd7744b5a%40%3Cdev.tika.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210507-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28657","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b@%3Cnotifications.james.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-567x-m4wm-87v8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28657","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210507-0004","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212098-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1151558","tags":["report"]},{"url":"https://bugzilla.suse.com/1172711","tags":["report"]},{"url":"https://bugzilla.suse.com/1175216","tags":["report"]},{"url":"https://bugzilla.suse.com/1178767","tags":["report"]},{"url":"https://bugzilla.suse.com/1180673","tags":["report"]},{"url":"https://bugzilla.suse.com/1182744","tags":["report"]},{"url":"https://bugzilla.suse.com/1183573","tags":["report"]},{"url":"https://bugzilla.suse.com/1183649","tags":["report"]},{"url":"https://bugzilla.suse.com/1183845","tags":["report"]},{"url":"https://bugzilla.suse.com/1183864","tags":["report"]},{"url":"https://bugzilla.suse.com/1184005","tags":["report"]},{"url":"https://bugzilla.suse.com/1184286","tags":["report"]},{"url":"https://bugzilla.suse.com/1184311","tags":["report"]},{"url":"https://bugzilla.suse.com/1184332","tags":["report"]},{"url":"https://bugzilla.suse.com/1184351","tags":["report"]},{"url":"https://bugzilla.suse.com/1184361","tags":["report"]},{"url":"https://bugzilla.suse.com/1184471","tags":["report"]},{"url":"https://bugzilla.suse.com/1184475","tags":["report"]},{"url":"https://bugzilla.suse.com/1184561","tags":["report"]},{"url":"https://bugzilla.suse.com/1184617","tags":["report"]},{"url":"https://bugzilla.suse.com/1184849","tags":["report"]},{"url":"https://bugzilla.suse.com/1184892","tags":["report"]},{"url":"https://bugzilla.suse.com/1184929","tags":["report"]},{"url":"https://bugzilla.suse.com/1184940","tags":["report"]},{"url":"https://bugzilla.suse.com/1185042","tags":["report"]},{"url":"https://bugzilla.suse.com/1185097","tags":["report"]},{"url":"https://bugzilla.suse.com/1185281","tags":["report"]},{"url":"https://bugzilla.suse.com/1185506","tags":["report"]},{"url":"https://bugzilla.suse.com/1185568","tags":["report"]},{"url":"https://bugzilla.suse.com/1185965","tags":["report"]},{"url":"https://bugzilla.suse.com/1186025","tags":["report"]},{"url":"https://bugzilla.suse.com/1186124","tags":["report"]},{"url":"https://bugzilla.suse.com/1186346","tags":["report"]},{"url":"https://bugzilla.suse.com/1186508","tags":["report"]},{"url":"https://bugzilla.suse.com/1186765","tags":["report"]},{"url":"https://bugzilla.suse.com/1186852","tags":["report"]},{"url":"https://bugzilla.suse.com/1186858","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31607","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212114-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182817","tags":["report"]},{"url":"https://bugzilla.suse.com/1184283","tags":["report"]},{"url":"https://bugzilla.suse.com/1184861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28657","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/03/30/3","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28657","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-28657","title":"Infinite loop in Apache Tika's MP3 parser","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","status":"published","published":"2021-03-31T07:35:14Z","modified":"2025-02-13T16:27:59.935Z","cwes":["CWE-835"],"updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-0949","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","status":"published","published":"2021-03-31T07:35:14Z","modified":"2025-02-13T16:27:59Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-567x-m4wm-87v8","title":"Infinite loop in Apache Tika","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","status":"published","published":"2021-05-10T15:23:25Z","modified":"2023-02-01T05:05:13Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-835"],"updated_at":"2026-11-02T14:36:32.918681Z"}],"nvd":[{"id":"CVE-2021-28657","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","status":"published","published":"2021-03-31T08:15:11.267Z","modified":"2026-06-17T03:46:43.16Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:06:51.197859Z"}],"osv":[{"id":"CVE-2021-28657","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","status":"published","published":"2021-03-31T08:15:11.267Z","modified":"2026-10-24T10:30:45.202049477Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28657","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","status":"published","published":"2021-03-31T08:15:11.267Z","modified":"2026-08-27T23:03:49.12721063Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-567x-m4wm-87v8","title":"Infinite loop in Apache Tika","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","status":"published","published":"2021-05-10T15:23:25Z","modified":"2024-02-17T05:34:30.13212Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-835"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"UBUNTU-CVE-2021-28657","description":"A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.","status":"published","published":"2021-03-31T08:15:00Z","modified":"2026-10-17T12:56:14.823650662Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"SUSE-SU-2021:2098-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\ncobbler:\n\n- Make `fence_ipmitool` a wrapper for `fence_ipmilan` using always `lanplus`. (bsc#1184361)\n- Remove unused template for `fence_ipmitool`.\n- Prevent some race conditions when writting tftpboot files and the destination directory is not existing. (bsc#1186124)\n- Fix trail stripping in case of using UTF symbols. (bsc#1184561)\n\ngolang-github-prometheus-node_exporter:\n\n- Update to 1.1.2\n  * Bug fixes\n    + Handle errors from disabled PSI subsystem\n    + Sanitize strings from /sys/class/power_supply\n    + Silence missing netclass errors\n    + Fix ineffassign issue\n    + Fix some noisy log lines\n    + filesystem_freebsd: Fix label values\n    + Fix various procfs parsing errors\n    + Handle no data from powersupplyclass\n    + udp_queues_linux.go: change upd to udp in two error strings\n    + Fix node_scrape_collector_success behaviour\n    + Fix NodeRAIDDegraded to not use a string rule expressions\n    + Fix node_md_disks state label from fail to failed\n    + Handle EPERM for syscall in timex collector\n    + bcache: fix typo in a metric name\n    + Fix XFS read/write stats\n  * Changes\n    + Improve filter flag names\n    + Add btrfs and powersupplyclass to list of exporters enabled by default\n  * Features\n    + Add fibre channel collector\n    + Expose cpu bugs and flags as info metrics\n    + Add network_route collector\n    + Add zoneinfo collector\n  * Enhancements\n    + Add more InfiniBand counters\n    + Add flag to aggr ipvs metrics to avoid high cardinality metrics\n    + Adding backlog/current queue length to qdisc collector\n    + Include TCP OutRsts in netstat metrics\n    + Add pool size to entropy collector\n    + Remove CGO dependencies for OpenBSD amd64\n    + bcache: add writeback_rate_debug status\n    + Add check state for mdadm arrays via node_md_state metric\n    + Expose XFS inode statistics\n    + Expose zfs zpool state\n    + Added an ability to pass collector.supervisord.url via SUPERVISORD_URL environment variable\n- Do not include sources (bsc#1151558)\n- Remove rc symlink\n\ngrafana-formula:\n\n- Fix Grafana dashboards requiring single series (bsc#1184471)\n\npatterns-suse-manager:\n\n- Add require for py27-compat-salt (salt 3002 does not provide\n  python2-salt anymore) \n\nprometheus-exporter-formula:\n\n- Add support for schema migration (bsc#1186025)\n\npxe-yomi-image-sle15:\n\n- Remove PermitEmptyPasswords from SSH config (Fix bsc#1182744)\n\npy26-compat-salt:\n\n- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)\n\nspacewalk-admin:\n\n- Stop jabberd when osa-dispatcher is enabled (bsc#1185042)\n\nspacewalk-backend:\n\n\n- Fix binary blob corruptions in tradidional config file deployment (bsc#1183864)\n- Fix for GPG checking on synchonizing mirrored dpkg repo (bsc#1184351)\n- switch to www group for satellite logs (bsc#1185097)\n- Fail traditional errata and package actions when they act on retracted items\n- Add advisory_status to reposync and ISS\n- Add minrate/timeout configuration values for downloading DEB/RPM packages\n\nspacewalk-branding:\n\n- Add the CSS class for retracted errata/packages\n\nspacewalk-certs-tools:\n\n\n- Add support of DISABLE_LOCAL_REPOS=0 for salt minions (bsc#1185568)\n- Add missing environment variable SALT_RUNNING for pkg module to the minion configuration\n- Fix typo: activaion -\u003e activation\n\nspacewalk-java:\n\n- Change Prometheus exporters formula data schema to make it more generic and extendable\n- Do not require advisory_status to be set in ErrataHandler.create (bsc#1185965)\n- Speed up pages to compare or add packages to channels (bsc#1178767)\n- Bugfix: Remove the unneeded check that was stopping updating a virtual instance\n  type (bsc#1180673)\n- Exclude minions from the list of locally-managed/sandbox systems when copying config\n  files (bsc#1184940)\n- Lower case fqdn comparation when calculating minion connection path (bsc#1184849)\n- Bugfix: Retracted Patches: Filter minion correctly when executing package\n  install (bsc#1184929)\n- Implement retracted patches\n- For a SUSE system get metadata and package from same source (bsc#1184475)\n- Check if the directory exists prior to modular data cleanup (bsc#1184311)\n- Assign right base product for res8 (bsc#1184005)\n- Fix docs link in my organization configuration (bsc#1184286)\n- Only update the kickstart path in cobbler if necessary (bsc#1175216)\n\nspacewalk-utils:\n\n- Bugfix for ubuntu-18.04 repo urls: multiverse, restricted and backports\n- Add multiverse, restricted and backports to Ubuntu 16.04, 18.04 and 20.04\n\nspacewalk-web:\n\n- Upgrade react-select to 4.3.0 and lodash to 4.17.21\n- Show the info about unsynced patches in the Content Lifecycle Management screens\n\nsusemanager:\n\n- Add bootstrap repo data for SUSE Manager 4.1 Proxy\n- Require gio-branding-SLE for SLE15 but not for openSUSE Leap 15\n- Add bootstrap repo data for OES2018-SP3-x86_64 (bsc#1183845)\n- Enable bootstrap repository creation for openSUSE Leap 15.3 for Uyuni\n- Add python3-distro to RES8, SLE15, Ubuntu20.04 and Debian 10 bootstrap\n  repositories to fix bootstrapping issues (bsc#1184332)\n- Add python3-pycryptodome to Ubuntu and Debian 10 bootstrap repos (bsc#1186346)\n- Add gnupg and its dependencies to debian 10 bootstrap repo\n\nsusemanager-build-keys:\n\n- Add SUSE Linux Enterprise 15-SP3 Updates for openSUSE Leap 15.3 key (bsc#1186852)\n\nsusemanager-doc-indexes:\n\n- Adds additional dependencies for Debian client registration\n  in Client Configuration Guide (bsc#1183649)\n- Remove some openSUSE Leap 15.1 references\n- Add reposync configuration settings to Troubleshooting chapter of\n  the Administration Guide\n- Update the entry about module.run for SAP Guide\n\nsusemanager-docs_en:\n\n- Adds additional dependencies for Debian client registration\n  in Client Configuration Guide (bsc#1183649)\n- Remove some openSUSE Leap 15.1 references\n- Add reposync configuration settings to Troubleshooting chapter of\n  the Administration Guide\n- Update the entry about module.run for SAP Guide\n\nsusemanager-schema:\n\n- DB schema \u0026 migrations for retracted patches\n\nsusemanager-sls:\n\n- Exclude openSUSE Leap 15.3 from product installation (bsc#1186858)\n- Enable certificate deployment for Leap 15.3 clients which is needed for bootstrapping (bsc#1186765)\n- Do not install python2-salt on Salt 3002.2 Docker build hosts (bsc#1185506)\n- Add support for 'disable_local_repos' salt minion config parameter(bsc#1185568)\n- Fix insecure JMX configuration (bsc#1184617)\n- Avoid conflicts with running ioloop on mgr_events engine (bsc#1172711)\n- Keep salt-minion when it is installed to prevent update problems with\n  dependend packages not available in the bootstrap repo (bsc#1183573)\n- Fix installation of gnupg on Debian 10\n\nsusemanager-sync-data:\n\n- Add OES2018 SP3 (bsc#1183845)\n\ntika-core:\n\n- New upstream version 1.26.\n  * Infinite loop in the MP3Parser (bsc#1184892 CVE-2021-28657)\n  * Out of memory error while loading a file in PDFBox before 2.0.23.\n  * Infinite loop while loading a file in PDFBox before 2.0.23.\n  * System.exit vulnerability in Tika's OneNote Parser; out of memory errors and/or infinite loops in Tika's \n    ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser.\n  * Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser\n  * Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser\n\nuyuni-common-libs:\n\n- Maintainer field in debian packages are only recommended (bsc#1186508)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n\n","status":"published","published":"2021-06-21T17:18:22Z","modified":"2026-02-04T02:27:23.930351Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2114-1","title":"Security update for SUSE Manager Server 4.0","description":"\nThis update fixes the following issues:\n\ncobbler:\n\n- Make 'fence_ipmitool' a wrapper for 'fence_ipmilan' using always lanplus (bsc#1184361)\n- Remove unused template for fence_ipmitool.\n- Prevent some race conditions when writing tftpboot files and\n  the destination directory is not existing (bsc#1186124)\n- Fix trail stripping in case of using UTF symbols (bsc#1184561)\n\ngrafana-formula:\n\n- Fix Grafana dashboards requiring single series (bsc#1184471)\n\npatterns-suse-manager:\n\n- Add require for py27-compat-salt (salt 3002 does not provide\n  python2-salt anymore) \n\nprometheus-exporters-formula:\n\n- Move exporters configurations to dedicated group `prometheus_exporters`\n- Add formula data schema migration script\n- This version changes the formula data schema and is not backwards compatible.\n  Downgrading from this version will require reconfiguring the formula for all your\n  minions.\n- Add Ubuntu support for Prometheus exporters' reverse proxy\n\npxe-default-image-sle15:\n\n- Adapt rpm-properties.xml for containment-rpm-pxe v0.2.1 and newer\n\npy26-compat-salt:\n\n- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)\n\nspacewalk-backend:\n\n- Maintainer field in debian packages are only recommended (bsc#1186508)\n- Switch to www group for satellite logs (bsc#1185097)\n\nspacewalk-java:\n\n- Change Prometheus exporters formula data schema to make it more generic and extendable\n- Adapt logging for testing accessability of URLs (bsc#1182817)\n- Fix problem reading product_tree.json from wrong location in offline setups (bsc#1184283)\n- For a SUSE system get metadata and package from same source (bsc#1184475)\n- Check if the directory exists prior to modular data cleanup (bsc#1184311)\n- Assign right base product for res8 (bsc#1184005)\n- Fix check for for mirrorlist URLs when refreshing products (bsc#1184861)\n\nspacewalk-utils:\n\n- Bugfix for ubuntu-18.04 repo urls: multiverse, restricted and backports\n- Add multiverse, restricted and backports to Ubuntu 16.04, 18.04 and 20.04\n\nspacewalk-web:\n\n- Update the WebUI version to 4.0.14\n\nsusemanager:\n\n- Add python3-pycryptodome to Ubuntu 18 and 20 bootstrap repos (bsc#1186346)\n- Require gio-branding-SLE for SLE15 but not for openSUSE Leap 15\n- Add python3-distro to RES8, SLE15 and Ubuntu20.04 bootstrap\n  repositories to fix bootstrapping issues (bsc#1184332)\n\nsusemanager-doc-indexes:\n\n- Update for Disconnected Setup chapter in Administration Guide  \n\nsusemanager-docs_en:\n\n- Update for Disconnected Setup chapter in Administration Guide \n\nsusemanager-sls:\n\n- Do not install python2-salt on Salt 3002.2 Docker build hosts (bsc#1185506)\n- Fix insecure JMX configuration (bsc#1184617)\n- Avoid conflicts with running ioloop on mgr_events engine (bsc#1172711)\n\ntika-core:\n\n- New upstream version 1.26. Fixes:\n  * Infinite loop in the MP3Parser (bsc#1184892, CVE-2021-28657)\n  * Out of memory error while loading a file in PDFBox before 2.0.23.\n  * Infinite loop while loading a file in PDFBox before 2.0.23.\n  * System.exit vulnerability in Tika's OneNote Parser; out of memory errors\n     and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser,\n     OneNoteParser and ImageParser.\n  * Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser\n  * Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser \n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\n`spacewalk-schema-upgrade`\n5. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2021-06-21T17:32:37Z","modified":"2026-02-04T02:46:39.175983Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}