Resource exhaustion in PDFBox - CVE-2021-27906

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU51605

Resource exhaustion in PDFBox - CVE-2021-27906

Published: March 22, 2021


Vulnerability identifier: #VU51605
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-27906
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing PDF files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

PDFBox
Oracle Outside In Technology
Oracle WebCenter Sites
Primavera Unifier
openEuler
Fedora
IBM Security Risk Manager
IBM QRadar Incident Forensics
pdfbox
xmpbox
fontbox
preflight
pdfbox-javadoc
pdfbox-debugger
pdfbox-reactor
pdfbox-parent
pdfbox-tools

How to mitigate CVE-2021-27906

Install update from vendor's website.

PDFBox - update to 2.0.23
IBM Security Risk Manager - update to 1.8.0.0
pdfbox - update to 2.0.23-1
xmpbox - update to 2.0.23-1
fontbox - update to 2.0.23-1
preflight - update to 2.0.23-1
pdfbox-javadoc - update to 2.0.23-1
pdfbox-debugger - update to 2.0.23-1
pdfbox-reactor - update to 2.0.23-1
pdfbox-parent - update to 2.0.23-1
pdfbox-tools - update to 2.0.23-1
pdfbox - addressed in versions 2.0.23-1.fc32, 2.0.23-1.fc33, 2.0.23-1.fc34
IBM QRadar Incident Forensics - addressed in versions 7.3.3.9, 7.4.3.1

External References

Related Security Bulletins