CVE-2021-43113
iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows comma ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA.
Descripción
iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.itextpdf:itext7-core, com.itextpdf:itextpdf | 7.1.17 y 1 más |
| debian 10 | libitext5-java | 5.5.13-1+deb10u1 |
| debian 11 | libitext5-java | 5.5.13.2-1+deb11u1 |
| debian 12 | libitext5-java | 5.5.13.3-1 |
| debian 13 | libitext5-java | 5.5.13.3-1 |
| debian 14 | libitext5-java | 5.5.13.3-1 |
| echo | libitext5-java | 5.5.13.3-1 |
Mostrar las 8 entradas de 7 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.itextpdf:itext7-core | 7.1.17 |
| maven::GitHub Security Advisory Maven | com.itextpdf:itextpdf | 5.5.13.3 |
| debian 10 | libitext5-java | 5.5.13-1+deb10u1 |
| debian 11 | libitext5-java | 5.5.13.2-1+deb11u1 |
| debian 12 | libitext5-java | 5.5.13.3-1 |
| debian 13 | libitext5-java | 5.5.13.3-1 |
| debian 14 | libitext5-java | 5.5.13.3-1 |
| echo | libitext5-java | 5.5.13.3-1 |
Referencias
- https://github.com/itext/itext7
- https://github.com/itext/itext7/releases/tag/7.1.17
- https://github.com/itext/itextpdf/releases/tag/5.5.13.3
- https://lists.debian.org/debian-lts-announce/2023/01/msg00013.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-43113
- https://pastebin.com/BXnkY9YY
- https://www.debian.org/security/2023/dsa-5323