~ / search / GHSA-c9jj-3wvg-q65h

GHSA-c9jj-3wvg-q65h

Vulnerability that affects org.apache.pdfbox:pdfbox

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-0228

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.pdfbox:pdfbox >= 2.0.14, < 2.0.15 2.0.15

Details

As written in the advisory (Markdown source, shown as plain text).

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

References

External links from the advisory. They lead to third-party sites.