CVE-2021-43113

iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.1.17"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.1.17"
                }
            ],
            "cpes": [
                "cpe:2.3:a:itextpdf:itext:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "itextpdf:itext"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "10.0"
                },
                {
                    "last_affected": "11.0"
                }
            ],
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "debian:debian_linux"
        }
    ]
}

References

Affected packages

Git / github.com/itext/itext-java

Affected ranges

Type

GIT

Repo

https://github.com/itext/itext-java

Events

Introduced

Fixed

a2746010d27536b68d60d53f81912d5a7c537b7e

Database specific

{
    "source": "REFERENCES"
}

Affected versions

7.*

7.0.0

7.0.0-RC.20160201

7.0.0-RC.20160321

7.0.0-RC.20160406

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

7.1.0

7.1.1

7.1.10

7.1.11

7.1.12

7.1.13

7.1.14

7.1.15

7.1.16

7.1.2

7.1.3

7.1.4

7.1.5

7.1.6

7.1.7

7.1.8

7.1.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-43113.json"

Git / github.com/itext/itextpdf

Affected ranges

Type

GIT

Repo

https://github.com/itext/itextpdf

Events

Introduced

Fixed

0231a60e92a1968601d1d7779dc3f57f1274f32f

Database specific

{
    "source": "REFERENCES"
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.1.0

5.1.1

5.1.2

5.1.3

5.2.0

5.2.1

5.3.0

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

5.4.0

5.4.1

5.4.2

5.4.3

5.4.4

5.4.5

5.5.0

5.5.1

5.5.10

5.5.11

5.5.12

5.5.13

5.5.13.1

5.5.13.2

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.5.8

5.5.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-43113.json"