CVE-2021-27807: Excessive Iteration Denial of Service in Apache PDFBox
Summary
CVE-2021-27807: Excessive Iteration Denial of Service in Apache PDFBox. Affects org.apache.pdfbox:pdfbox versions >= 2.0.0, < 2.0.23. Fixed in 2.0.23. How to fix ↓
Also tracked for
- libpdfbox2-java · Debian:11
The same CVE-2021-27807 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache PDFBox is an open-source Java library for working with PDF documents. It provides functionality for creating, manipulating, and extracting content from PDF files. The library is widely used in various applications and frameworks that deal with PDF files. However, versions 2.0.22 and prior of Apache PDFBox are vulnerable to an Excessive Iteration Denial of Service attack.
Vulnerability Detail
The vulnerability arises from a flaw in the PDF file loading process. An attacker can craft a malicious PDF file that triggers an infinite loop during the loading process. This can lead to a denial of service condition, where the application becomes unresponsive or crashes. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level. It affects Apache PDFBox versions 2.0.22 and prior.
How To Fix
Minimum fixed version
2.0.23
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of Apache PDFBox to mitigate the risk.
Conclusion
The Excessive Iteration Denial of Service vulnerability in Apache PDFBox can be mitigated by updating to version 2.0.23 or later. It is crucial for developers to ensure their dependencies are using the patched version to protect their applications from potential denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.pdfbox:pdfbox →
FAQ
Apache PDFBox is a Java library for working with PDF documents. It provides functionality for creating, manipulating, and extracting content from PDF files.
The vulnerability can lead to a denial of service condition, where the application becomes unresponsive or crashes.
Versions 2.0.22 and prior of Apache PDFBox are affected by this vulnerability.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
No, there is no known workaround. It is recommended to update to the patched version of Apache PDFBox.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pdfbox:pdfbox.
