Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS04NnA5LXg1cHctOTRxeM32WA
Improper Restriction of XML External Entity Reference in iText
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
Permalink: https://github.com/advisories/GHSA-86p9-x5pw-94qxJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NnA5LXg1cHctOTRxeM32WA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: about 2 months ago
CVSS Score: 8.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Identifiers: GHSA-86p9-x5pw-94qx, CVE-2017-9096
References:
- https://nvd.nist.gov/vuln/detail/CVE-2017-9096
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-017_itext_xml_external_entity_attack.txt
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://www.securityfocus.com/archive/1/541483/100/0/threaded
- https://github.com/advisories/GHSA-86p9-x5pw-94qx
Affected Packages
maven:com.lowagie:itext
Dependent packages: 283Dependent repositories: 7,819
Downloads:
Affected Version Ranges: <= 4.2.2
No known fixed version
All affected versions: 1.1.4, 1.2.3, 1.3.1, 1.4.8, 2.0.1, 2.0.6, 2.0.7, 2.0.8, 2.1.0, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.7, 4.2.0, 4.2.1, 4.2.2
maven:com.itextpdf:itextpdf
Dependent packages: 343Dependent repositories: 7,964
Downloads:
Affected Version Ranges: >= 7.0.0, < 7.0.3, < 5.5.12
Fixed in: 7.0.3, 5.5.12
All affected versions: 5.0.6, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.2.0, 5.2.1, 5.3.0, 5.3.1, 5.3.2, 5.3.4, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11
All unaffected versions: 5.5.12, 5.5.13