CVE-2021-43113

iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "10.0"
                        },
                        {
                            "last_affected":  "10.0"
                        },
                        {
                            "introduced":  "11.0"
                        },
                        {
                            "last_affected":  "11.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "debian:debian_linux"
        }
    ]
}

References

Affected packages

Git / github.com/itext/itext-java

Affected ranges

Type

GIT

Repo

https://github.com/itext/itext-java

Events

Introduced

ed042f3ff209ceb0a5571415937bb5aaba8bd5ff

Fixed

a2746010d27536b68d60d53f81912d5a7c537b7e

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:itextpdf:itext:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0"
                },
                {
                    "fixed":  "7.1.17"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "original_tag":  "7.1.17",
            "range":  [
                {
                    "fixed":  "a2746010d27536b68d60d53f81912d5a7c537b7e"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

7.1.0

7.1.1

7.1.10

7.1.11

7.1.12

7.1.13

7.1.14

7.1.15

7.1.16

7.1.2

7.1.3

7.1.4

7.1.5

7.1.6

7.1.7

7.1.8

7.1.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43113.json"

Git / github.com/itext/itextpdf

Affected ranges

Type

GIT

Repo

https://github.com/itext/itextpdf

Events

Introduced

Fixed

0231a60e92a1968601d1d7779dc3f57f1274f32f

Database specific

Show details

{
    "extracted_events":  [
        {
            "original_tag":  "5.5.13.3",
            "range":  [
                {
                    "fixed":  "0231a60e92a1968601d1d7779dc3f57f1274f32f"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.1.0

5.1.1

5.1.2

5.1.3

5.2.0

5.2.1

5.3.0

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

5.4.0

5.4.1

5.4.2

5.4.3

5.4.4

5.4.5

5.5.0

5.5.1

5.5.10

5.5.11

5.5.12

5.5.13

5.5.13.1

5.5.13.2

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.5.8

5.5.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43113.json"