Long Running Computation Vulnerability in Apache PDFBox (CVE-2018-11797)
Summary
CVE-2018-11797: In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. Affects libpdfbox-java versions < 1:1.8.16-1. Fixed in 1:1.8.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache PDFBox is an open-source Java library that allows users to create, manipulate, and extract content from PDF documents. It is widely used for its ability to handle PDF files programmatically. However, certain versions of PDFBox are susceptible to a vulnerability that can lead to excessive computation time when processing specially crafted PDF files, impacting performance and usability.
Vulnerability Detail
CVE-2018-11797 is a vulnerability found in Apache PDFBox versions 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11. The flaw arises when the library attempts to parse a page tree from a maliciously crafted PDF file, which can trigger an extremely long-running computation. This can lead to denial of service conditions, as the application may become unresponsive while processing the PDF, potentially affecting user experience and system stability.
How To Fix
Minimum fixed version
1:1.8.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpdfbox-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider avoiding the processing of untrusted PDF files until the upgrade can be performed. Implementing input validation to reject suspicious PDF files may also help mitigate the risk temporarily.
Conclusion
CVE-2018-11797 represents a significant vulnerability in Apache PDFBox that can lead to performance issues when processing malicious PDF files. Users are strongly advised to upgrade to the latest versions of the affected packages to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for libpdfbox-java →
FAQ
CVE-2018-11797 is a vulnerability in Apache PDFBox that allows specially crafted PDF files to cause extremely long computation times when parsed.
The affected versions are Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial of service conditions, where the application becomes unresponsive due to excessive computation time when processing malicious PDF files.
The CVSS score for CVE-2018-11797 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libpdfbox-java.
