CVE-2021-31812 (High) detected in pdfbox-2.0.12.jar - autoclosed

[mend-bolt-for-github[bot]]

CVE-2021-31812 - High Severity Vulnerability

Vulnerable Library - pdfbox-2.0.12.jar

The Apache PDFBox library is an open source Java tool for working with PDF documents.

Path to dependency file: First_real_scan/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/pdfbox/pdfbox/2.0.12/pdfbox-2.0.12.jar,First_real_scan/target/libs/compile/pdfbox-2.0.12.jar

Dependency Hierarchy: - :x: **pdfbox-2.0.12.jar** (Vulnerable Library)

Found in HEAD commit: 517ce877d9ca28b78d99878eae6078eb4dbd1e1b

Found in base branch: main

Vulnerability Details

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

Publish Date: 2021-06-12

URL: CVE-2021-31812

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31812

Release Date: 2021-06-12

Fix Resolution: org.apache.pdfbox:pdfbox:2.0.24, org.apache.pdfbox:pdfbox-app:2.0.24

---

Step up your Open Source Security Game with WhiteSource here

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #228

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #228