veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
{
"cwe_ids": [
"CWE-91"
]
}[
{
"id": "CVE-2024-28109-68d8a46e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "core/src/main/java/org/verapdf/policy/PolicyChecker.java"
},
"digest": {
"line_hashes": [
"224328017688963579429047543276332622691",
"253495606006731938297965456417576031596",
"208107536836371313768515420362726076099",
"240578709705639387227594024464916772965",
"94024315187233117371038954304987097606",
"225769169320645258892164601130407247295",
"64794483530284407491848938715549914885",
"272800470640206410122280763977004664587",
"156932971524137884292793579576906935401",
"107189704998523357392636661063618605730",
"119601254455757965076760477389806806194",
"138166216149321281900164122458489691970",
"11943939343719906000813310495673874763",
"35300549163924853715016977494395208438",
"248599257197480896120833193527092472669",
"261200544252286114637012428144588156977"
],
"threshold": 0.9
},
"source": "https://github.com/verapdf/verapdf-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe"
},
{
"id": "CVE-2024-28109-858db0b5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "core/src/main/java/org/verapdf/report/XsltTransformer.java"
},
"digest": {
"line_hashes": [
"314024327165131025719359155641703627087",
"153485509858851554164757819449810500174",
"99671310537622811683114623434531180964",
"278856627166843397374098825868273035592",
"94024315187233117371038954304987097606",
"68401101661147721262409273196762375016",
"212316229998943900538346054529279408659",
"238550609166701848284992526505467900221",
"222855551540734671196943360343421868759",
"165860902596739093650826672912782776156",
"135630607161910714903073014893185802371"
],
"threshold": 0.9
},
"source": "https://github.com/verapdf/verapdf-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe"
},
{
"id": "CVE-2024-28109-939a9246",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "core/src/main/java/org/verapdf/policy/SchematronPipeline.java"
},
"digest": {
"line_hashes": [
"258197942930372520807232347724110843674",
"321517328457344202773345465738423935872",
"55691878878564924380722908300775341661",
"128811363057000024621762920757818299371",
"104857820877417341818050995754102403058",
"8321216550991638146802355065206854513",
"4654243613873196762169853584461005995",
"243272454754186338166362573584960041911",
"321699211789779336595589911859547959141",
"276631690930558555844825754640543527160"
],
"threshold": 0.9
},
"source": "https://github.com/verapdf/verapdf-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe"
},
{
"id": "CVE-2024-28109-dc4351d9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "core/src/main/java/org/verapdf/policy/SchematronPipeline.java",
"function": "getTransformerFactory"
},
"digest": {
"function_hash": "77615674395939447696874967233975857252",
"length": 108.0
},
"source": "https://github.com/verapdf/verapdf-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe"
}
]