Open mend-bolt-for-github[bot] opened 3 years ago
The Apache PDFBox library is an open source Java tool for working with PDF documents.
Library home page: https://www.apache.org/
Path to dependency file: www.renfei.net/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/pdfbox/pdfbox/2.0.22/pdfbox-2.0.22.jar
Dependency Hierarchy: - sdk-1.1.1.jar (Root Library) - poi-ooxml-5.0.0.jar - graphics2d-0.30.jar - :x: **pdfbox-2.0.22.jar** (Vulnerable Library)
Found in base branch: master
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Publish Date: 2021-06-12
URL: CVE-2021-31811
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31811
Release Date: 2021-06-12
Fix Resolution: org.apache.pdfbox:pdfbox:2.0.24, org.apache.pdfbox:pdfbox-app:2.0.24
Step up your Open Source Security Game with WhiteSource here
CVE-2021-31811 - Medium Severity Vulnerability
Vulnerable Library - pdfbox-2.0.22.jar
The Apache PDFBox library is an open source Java tool for working with PDF documents.
Library home page: https://www.apache.org/
Path to dependency file: www.renfei.net/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/pdfbox/pdfbox/2.0.22/pdfbox-2.0.22.jar
Dependency Hierarchy: - sdk-1.1.1.jar (Root Library) - poi-ooxml-5.0.0.jar - graphics2d-0.30.jar - :x: **pdfbox-2.0.22.jar** (Vulnerable Library)
Found in base branch: master
Vulnerability Details
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Publish Date: 2021-06-12
URL: CVE-2021-31811
CVSS 3 Score Details (5.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31811
Release Date: 2021-06-12
Fix Resolution: org.apache.pdfbox:pdfbox:2.0.24, org.apache.pdfbox:pdfbox-app:2.0.24
Step up your Open Source Security Game with WhiteSource here