GitHub Advisoryadvisory · Maven

GHSA-gv87-q66h-4277 Command injection in itext7-core

CRITICAL Published 2021-12-16 Modified 2022-01-25 Official page ↗
Aliases
CVE-2021-43113
Ecosystem
Maven
Packages
com.itextpdf:itext7-core, com.itextpdf:itextpdf
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2022-01-25

Affected packages

• Maven com.itextpdf:itext7-core: < 7.1.17 → fixed in 7.1.17 • Maven com.itextpdf:itextpdf: < 5.5.13.3 → fixed in 5.5.13.3

Description

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

Related

Alias · CVE (1)

  • CVE-2021-43113 iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References