CVE-2019-0228: Vulnerability in org.apache.pdfbox:pdfbox
Summary
CVE-2019-0228: Vulnerability that affects org.apache.pdfbox:pdfbox. Affects org.apache.pdfbox:pdfbox versions >= 2.0.14, < 2.0.15. Fixed in 2.0.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.pdfbox:pdfbox is a Maven package that provides functionality for working with PDF documents. It is widely used for tasks such as reading, writing, and manipulating PDF files. However, version 2.0.14 of Apache PDFBox has a vulnerability that affects its XML parser initialization, making it susceptible to XML External Entity (XXE) attacks when processing crafted XFDF files.
Vulnerability Detail
The vulnerability in Apache PDFBox 2.0.14 arises from improper initialization of the XML parser. This flaw allows context-dependent attackers to exploit XML External Entity (XXE) attacks by supplying a specially crafted XFDF file. XXE attacks can lead to information disclosure, denial of service, or even remote code execution, depending on the attacker's capabilities. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
2.0.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the fixed version of org.apache.pdfbox:pdfbox as soon as possible.
Conclusion
The vulnerability in org.apache.pdfbox:pdfbox (CVE-2019-0228) allows for XML External Entity (XXE) attacks when processing crafted XFDF files. It is crucial to update to version 2.0.15 or later to fix this vulnerability and protect your application from potential information disclosure, denial of service, or remote code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.pdfbox:pdfbox →
FAQ
org.apache.pdfbox:pdfbox is a Maven package that provides functionality for working with PDF documents. It is commonly used for tasks such as reading, writing, and manipulating PDF files.
An XML External Entity (XXE) attack is a type of attack that exploits vulnerabilities in XML parsers. By injecting malicious XML entities, an attacker can potentially access sensitive information, perform denial of service attacks, or execute remote code.
This vulnerability can lead to various consequences depending on the attacker's capabilities. It may result in information disclosure, denial of service, or even remote code execution on the affected system.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to update to version 2.0.15 or later of org.apache.pdfbox:pdfbox. This version includes the necessary fixes to mitigate the XXE vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pdfbox:pdfbox.
