danfickle / openhtmltopdf

An HTML to PDF library for the JVM. Based on Flying Saucer and Apache PDF-BOX 2. With SVG image support. Now also with accessible PDF support (WCAG, Section 508, PDF/UA)!
https://danfickle.github.io/pdf-templates/index.html
Other
1.93k stars 359 forks source link

openhtmltopdf-rtl-support: Upgrade icu4j to > 63.1 to mitigate CVE-2018-18928 #843

Open habizzle opened 2 years ago

habizzle commented 2 years ago

openhtmltopdf-rtl-support currently uses icu4j v59.1 which seems to be affected by the vulnerability. The mentioned security vulnerability https://nvd.nist.gov/vuln/detail/CVE-2018-18928 states, that this applies to the C-Version, but the fix also contained changes to Java files - so I assume it would be better to update the Java library used.

openhtmltopdf-rtl-support compiles against the latest version, 71.1 and my tests with some RTL text did not find any issues so I guess the version could just be bumped.