Command Injection Affecting com.itextpdf:io Open this link in a new tab package, versions [,7.1.17)
Exploit Maturity
Proof of concept
Attack Complexity
Low
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-COMITEXTPDF-2320389
-
published
15 Dec 2021
-
disclosed
15 Dec 2021
-
credit
Gabriele Zuddas
Introduced: 15 Dec 2021
CVE-2021-43113 Open this link in a new tabHow to fix?
Upgrade com.itextpdf:io
to version 7.1.17 or higher.
Overview
com.itextpdf:io is a package that represents the next level of SDKs for developers that want to take advantage of the benefits PDF can bring. Equipped with a better document engine, high and low-level programming capabilities and the ability to create, edit and enhance PDF documents, iText 7 can be a boon to nearly every workflow.
Affected versions of this package are vulnerable to Command Injection. An attacker controlling the filename passed to the CompareTool
class, is able to inject arbitrary parameters in the command line being executed (ghostscript
). The vulnerable code resides inside com/itextpdf/io/util/GhostscriptHelper.java
.