CVE-2021-43113

iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

References

Affected packages

Git / github.com/itext/itext-java

Affected ranges

Type
Repo: https://github.com/itext/itext-java
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

a2746010d27536b68d60d53f81912d5a7c537b7e

Type

GIT

Repo

https://github.com/itext/itext7

Events

Introduced

ed042f3ff209ceb0a5571415937bb5aaba8bd5ff

Fixed

a2746010d27536b68d60d53f81912d5a7c537b7e

Database specific

{
    "versions": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.1.17"
        }
    ]
}

Type
Repo: https://github.com/itext/itextpdf
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0231a60e92a1968601d1d7779dc3f57f1274f32f

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43113.json"