Homepage About Snyk

Command Injection Affecting com.itextpdf:io package, versions [,7.1.17)

0.0
high

  • Exploit Maturity

    Proof of concept

  • Attack Complexity

    Low

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-COMITEXTPDF-2320389

  • published

    15 Dec 2021

  • disclosed

    15 Dec 2021

  • credit

    Gabriele Zuddas

Report a new vulnerability Found a mistake?

Introduced: 15 Dec 2021

CVE-2021-43113 Open this link in a new tab
CWE-78 Open this link in a new tab

How to fix?

Upgrade com.itextpdf:io to version 7.1.17 or higher.

Overview

com.itextpdf:io is a package that represents the next level of SDKs for developers that want to take advantage of the benefits PDF can bring. Equipped with a better document engine, high and low-level programming capabilities and the ability to create, edit and enhance PDF documents, iText 7 can be a boon to nearly every workflow.

Affected versions of this package are vulnerable to Command Injection. An attacker controlling the filename passed to the CompareTool class, is able to inject arbitrary parameters in the command line being executed (ghostscript). The vulnerable code resides inside com/itextpdf/io/util/GhostscriptHelper.java .