GHSA-gv87-q66h-4277

Command injection in itext7-core

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-43113

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.itextpdf:itext7-core	< 7.1.17	7.1.17
Maven	com.itextpdf:itextpdf	< 5.5.13.3	5.5.13.3

Details

As written in the advisory (Markdown source, shown as plain text).

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-43113 advisory
https://github.com/itext/itext7 package
https://github.com/itext/itext7/releases/tag/7.1.17 web
https://github.com/itext/itextpdf/releases/tag/5.5.13.3 web
https://lists.debian.org/debian-lts-announce/2023/01/msg00013.html web
https://pastebin.com/BXnkY9YY web
https://www.debian.org/security/2023/dsa-5323 web