CVE-2019-0228
- Source
- https://cve.org/CVERecord?id=CVE-2019-0228
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-0228.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-0228
- Aliases
- Published
- 2019-04-17T15:29:00.703Z
- Modified
- 2026-07-08T05:53:21.391351413Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE", "extracted_events": [ { "introduced": "8.0.0.0" }, { "last_affected": "8.2.4.0" } ], "vendor_product": "oracle:communications_session_report_manager" }, { "cpes": [ "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "fedoraproject:fedora", "extracted_events": [ { "introduced": "29" }, { "last_affected": "29" }, { "introduced": "30" }, { "last_affected": "30" } ] }, { "cpes": [ "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "14.2" }, { "last_affected": "14.2" }, { "introduced": "14.3" }, { "last_affected": "14.3" }, { "introduced": "14.5" }, { "last_affected": "14.5" } ], "vendor_product": "oracle:banking_corporate_lending_process_management" }, { "cpes": [ "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "14.2" }, { "last_affected": "14.2" }, { "introduced": "14.3" }, { "last_affected": "14.3" }, { "introduced": "14.5" }, { "last_affected": "14.5" } ], "vendor_product": "oracle:banking_credit_facilities_process_management" }, { "cpes": [ "cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "oracle:banking_supply_chain_finance", "extracted_events": [ { "introduced": "14.2" }, { "last_affected": "14.2" }, { "introduced": "14.3" }, { "last_affected": "14.3" }, { "introduced": "14.5" }, { "last_affected": "14.5" } ] }, { "cpes": [ "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "14.2" }, { "last_affected": "14.2" }, { "introduced": "14.3" }, { "last_affected": "14.3" }, { "introduced": "14.5" }, { "last_affected": "14.5" } ], "vendor_product": "oracle:banking_trade_finance_process_management" }, { "cpes": [ "cpe:2.3:a:oracle:banking_virtual_account_management:14.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "oracle:banking_virtual_account_management", "extracted_events": [ { "introduced": "14.2" }, { "last_affected": "14.2" }, { "introduced": "14.3.0" }, { "last_affected": "14.3.0" }, { "introduced": "14.5" }, { "last_affected": "14.5" } ] }, { "cpes": [ "cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*", "cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "oracle:communications_messaging_server", "extracted_events": [ { "introduced": "8.1" }, { "last_affected": "8.1" }, { "introduced": "8.1" }, { "last_affected": "8.1" } ] }, { "cpes": [ "cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.6.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "11.1.2.4" }, { "last_affected": "11.1.2.4" }, { "introduced": "11.2.6.0" }, { "last_affected": "11.2.6.0" } ], "vendor_product": "oracle:hyperion_financial_reporting" }, { "cpes": [ "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "8.58" }, { "last_affected": "8.58" }, { "introduced": "8.59" }, { "last_affected": "8.59" } ], "vendor_product": "oracle:peoplesoft_enterprise_peopletools" }, { "cpes": [ "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "16.0.6" }, { "last_affected": "16.0.6" }, { "introduced": "17.0" }, { "last_affected": "17.0" }, { "introduced": "18.0.3" }, { "last_affected": "18.0.3" } ], "vendor_product": "oracle:retail_xstore_point_of_service" }, { "cpes": [ "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "12.2.1.3.0" }, { "last_affected": "12.2.1.3.0" }, { "introduced": "12.2.1.4.0" }, { "last_affected": "12.2.1.4.0" } ], "vendor_product": "oracle:webcenter_sites" } ] }- References
-
- https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79%40%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c%40%3Ccommits.tika.apache.org%3E
- https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd%40%3Cserver-dev.james.apache.org%3E
- https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4%40%3Ccommits.tika.apache.org%3E
- https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d%40%3Cusers.pdfbox.apache.org%3E
- https://lists.apache.org/thread.html/r32b8102392a174b17fd19509a9e76047f74852b77b7bf46af95e45a2%40%3Cserver-dev.james.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Affected packages
Git / github.com/apache/james-project
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/james-project
- Events
-
IntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:apache:james:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:james:3.4.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "3.3.0" }, { "last_affected": "3.3.0" }, { "introduced": "3.4.0" }, { "last_affected": "3.4.0" } ] }