Infinite Loop Vulnerability in Apache PDFBox (libpdfbox2-java) - CVE-2021-27807
Summary
CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. Affects libpdfbox2-java versions < 2.0.23-1. Fixed in 2.0.23-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache PDFBox is an open-source Java library that allows users to create, manipulate, and extract content from PDF documents. It is widely used in various applications for handling PDF files due to its robust features and ease of use. However, certain versions of PDFBox, specifically version 2.0.22 and earlier, are vulnerable to a crafted PDF file that can trigger an infinite loop during the loading process, potentially leading to denial of service.
Vulnerability Detail
CVE-2021-27807 is a vulnerability that arises from the way Apache PDFBox processes PDF files. A specially crafted PDF can cause the library to enter an infinite loop while attempting to load the file. This can result in excessive resource consumption, leading to application crashes or unresponsiveness. The vulnerability affects versions 2.0.22 and earlier, and it is crucial for users to upgrade to a fixed version to mitigate the risk.
How To Fix
Minimum fixed version
2.0.23-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpdfbox2-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to restrict the types of PDF files that can be processed by your application. This may help mitigate the risk of encountering crafted PDF files that exploit this vulnerability.
Conclusion
CVE-2021-27807 presents a significant risk to applications using vulnerable versions of Apache PDFBox. Users are strongly advised to upgrade to version 2.0.23 or later to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until an upgrade is feasible.
See every vulnerability recorded for libpdfbox2-java →
FAQ
CVE-2021-27807 is a vulnerability in Apache PDFBox that allows a specially crafted PDF file to trigger an infinite loop during loading, potentially causing denial of service.
Versions 2.0.22 and earlier are affected by this vulnerability. Users should upgrade to version 2.0.23 or later.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploiting this vulnerability can lead to excessive resource consumption, causing applications to crash or become unresponsive.
The CVSS score for CVE-2021-27807 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libpdfbox2-java.
