Apache tika core vulnarability

Question

Hello,

We are using AEM 6.5.22 (on premise version). which uses Apache Tika-core and Tika-parsers bundles with versions 1.28.5.
Our Infosec team has reported a vulnerability on these versions and suggested to use the versions 3.2.2 and above.

As I checked the maven repository : https://mvnrepository.com/artifact/org.apache.tika/tika-core all the versions below 3.2.2 have vulnerability.

We cannot directly updated the versions on our side as this is OOTB.
Also, when checked with the latest service pack (6.5.25) also doesn’t have latest tika-core.

Any thoughts/suggestions would be much appreciated.

Regards,

Rohit

lukasz-m · Accepted Answer

Hi ​@RohitKu15,Please check this page for all the details:https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-35659Additionally you can find a HF that is applicable for AEM 6.5.21 or newer.Here is an url:https://experience.adobe.com/#/downloads/content/software-distribution/en/aem.html?fulltext=66516*&orderby=%40jcr%3Acontent%2Fjcr%3AlastModified&orderby.sort=desc&layout=list&p.offset=0&p.limit=2&package=%2Fcontent%2Fsoftware-distribution%2Fen%2Fdetails.html%2Fcontent%2Fdam%2Faem%2Fpublic%2Fadobe%2Fpackages%2Fcq650%2Fhotfix%2Fcq-6.5.0-hotfix-GRANITE-63488-SP21-1.4.zip

Sign up

Login with SSO

Login to the community

Login with SSO