Resource exhaustion in PDFBox - CVE-2021-31811

Vulnerability identifier: #VU54079

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31811

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing PDF files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

PDFBox
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Control Center
DataQuant for z/OS
IBM Enterprise Content Management Text Search
IBM Watson Compare and Comply for IBM Cloud Pak for Data
IBM Security Risk Manager
IBM FileNet Content Manager
openEuler
Fedora
pdfbox
xmpbox
fontbox
preflight
pdfbox-javadoc
pdfbox-debugger
pdfbox-reactor
pdfbox-parent
pdfbox-tools

Install updates from vendor's website.

PDFBox - update to 2.0.24
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 4.0.2
IBM Watson Compare and Comply for IBM Cloud Pak for Data - update to 1.1.13
IBM Security Risk Manager - update to 1.8.0.0
pdfbox - update to 2.0.24-1
xmpbox - update to 2.0.24-1
fontbox - update to 2.0.24-1
preflight - update to 2.0.24-1
pdfbox-javadoc - update to 2.0.24-1
pdfbox-debugger - update to 2.0.24-1
pdfbox-reactor - update to 2.0.24-1
pdfbox-parent - update to 2.0.24-1
pdfbox-tools - update to 2.0.24-1
pdfbox - addressed in versions 2.0.24-1.fc33, 2.0.24-1.fc34

• https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3E
• https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e@%3Cusers.pdfbox.apache.org%3E
• https://lists.apache.org/thread.html/rf937c2236e6c79cdb99f76a70690dd345e53dbe0707cb506a202e43e@%3Cannounce.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/06/12/2
• https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E

• Denial of service in Apache PDFBox
• IBM Watson Discovery for IBM Cloud Pak for Data update for Apache PDFBox
• Multiple vulnerabilities in IBM Watson Compare and Comply for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in IBM FileNet Content Manager
• Multiple vulnerabilities in IBM DataQuant for z/OS
• Multiple vulnerabilities in IBM Security Risk Manager on CP4S
• openEuler 20.03 LTS SP1 update for pdfbox
• Fedora 34 update for pdfbox
• Fedora 33 update for pdfbox