CVE-2021-27906: Uncontrolled Memory Allocation in Apache PDFBox
Summary
CVE-2021-27906: Uncontrolled Memory Allocation in Apache PDFBox. Affects org.apache.pdfbox:pdfbox versions >= 2.0.0, < 2.0.23. Fixed in 2.0.23. How to fix ↓
Also tracked for
- libpdfbox2-java · Debian:11
The same CVE-2021-27906 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache PDFBox is an open-source Java library for working with PDF documents. It provides functionality for creating, manipulating, and extracting content from PDF files. The library is widely used in various applications and frameworks that require PDF processing capabilities. However, versions 2.0.22 and prior of Apache PDFBox are vulnerable to an uncontrolled memory allocation issue.
Vulnerability Detail
The vulnerability arises when a specially crafted PDF file is loaded, triggering an OutOfMemory-Exception. An attacker can exploit this vulnerability by enticing a user to open a malicious PDF file, potentially leading to a denial-of-service condition. The issue has a CVSSv3 score of 5.5, indicating a moderate severity level. The vulnerability is tracked as CVE-2021-27906 and has been reviewed by GitHub. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-789.
How To Fix
Minimum fixed version
2.0.23
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of Apache PDFBox.
Conclusion
The uncontrolled memory allocation vulnerability in Apache PDFBox can be mitigated by upgrading to version 2.0.23 or later. It is crucial to promptly apply the fix to prevent potential denial-of-service attacks. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.pdfbox:pdfbox →
FAQ
Apache PDFBox is a Java library for working with PDF documents. It provides functionality for creating, manipulating, and extracting content from PDF files.
The vulnerability can be exploited by an attacker to cause an OutOfMemory-Exception, potentially leading to a denial-of-service condition.
The vulnerability has a CVSSv3 score of 5.5, indicating a moderate severity level.
To fix this vulnerability, upgrade to Apache PDFBox version 2.0.23 or later.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the patched version of Apache PDFBox.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pdfbox:pdfbox.
