Open mend-bolt-for-github[bot] opened 3 years ago
The Apache PDFBox library is an open source Java tool for working with PDF documents.
Library home page: https://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/pdfbox/pdfbox/2.0.22/pdfbox-2.0.22.jar
Dependency Hierarchy: - poi-ooxml-5.0.0.jar (Root Library) - graphics2d-0.30.jar - :x: **pdfbox-2.0.22.jar** (Vulnerable Library)
Found in HEAD commit: 49bc97d287f40c56cedf968f62c42374c32e123c
Found in base branch: master
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Publish Date: 2021-03-19
URL: CVE-2021-27807
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27807
Release Date: 2021-03-19
Fix Resolution (org.apache.pdfbox:pdfbox): 2.0.23
Direct dependency fix Resolution (org.apache.poi:poi-ooxml): 5.1.0
Step up your Open Source Security Game with Mend here
CVE-2021-27807 - Medium Severity Vulnerability
The Apache PDFBox library is an open source Java tool for working with PDF documents.
Library home page: https://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/pdfbox/pdfbox/2.0.22/pdfbox-2.0.22.jar
Dependency Hierarchy: - poi-ooxml-5.0.0.jar (Root Library) - graphics2d-0.30.jar - :x: **pdfbox-2.0.22.jar** (Vulnerable Library)
Found in HEAD commit: 49bc97d287f40c56cedf968f62c42374c32e123c
Found in base branch: master
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Publish Date: 2021-03-19
URL: CVE-2021-27807
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27807
Release Date: 2021-03-19
Fix Resolution (org.apache.pdfbox:pdfbox): 2.0.23
Direct dependency fix Resolution (org.apache.poi:poi-ooxml): 5.1.0
Step up your Open Source Security Game with Mend here