Critical Performance Vulnerability in libpdfbox-java and libpdfbox2-java Packages
Summary
DEBIAN-CVE-2018-11797: In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. Affects libpdfbox-java versions < 1:1.8.16-1. Fixed in 1:1.8.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpdfbox-java and libpdfbox2-java are Java libraries used for creating and manipulating PDF documents. They provide functionalities such as rendering, printing, and editing PDF files. However, certain versions of these libraries are vulnerable to a performance issue that can lead to excessive resource consumption when processing specially crafted PDF files.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11797, exists in Apache PDFBox versions 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11. It allows an attacker to craft a malicious PDF file that, when parsed, can trigger an extremely long-running computation. This can lead to denial of service, as the affected system may become unresponsive due to high CPU usage and resource exhaustion.
How To Fix
Minimum fixed version
1:1.8.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpdfbox-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid opening untrusted PDF files or implement strict validation checks on PDF files before processing them. This can help mitigate the risk of encountering the vulnerability until the package is updated.
Conclusion
The CVE-2018-11797 vulnerability in libpdfbox-java and libpdfbox2-java poses a significant risk due to its potential for denial of service through resource exhaustion. It is crucial to update to the patched versions to mitigate this risk and ensure the security of applications utilizing these libraries.
See every vulnerability recorded for libpdfbox-java →
FAQ
CVE-2018-11797 is a vulnerability in Apache PDFBox that allows for denial of service through long-running computations when parsing malicious PDF files.
The affected versions are libpdfbox-java 1.8.0 to 1.8.15 and libpdfbox2-java 2.0.0RC1 to 2.0.11.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
If an immediate update is not possible, avoid processing untrusted PDF files and implement validation checks to minimize risk.
More details can be found in the official Debian CVE database or by visiting the Vulert website, which provides tools for monitoring vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpdfbox-java.
