Infinite loop in PDFBox - CVE-2021-31812

Vulnerability identifier: #VU54080

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31812

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing PDF files. A remote attacker can consume all available system resources and cause denial of service conditions.

PDFBox
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Control Center
Infrastructure Technology
Oracle Banking Treasury Management
Oracle Banking Trade Finance
DataQuant for z/OS
IBM Enterprise Content Management Text Search
Oracle FLEXCUBE Universal Banking
Oracle Retail Xstore Point of Service
IBM Watson Compare and Comply for IBM Cloud Pak for Data
IBM Security Risk Manager
IBM FileNet Content Manager
Oracle Communications Instant Messaging Server
Oracle WebCenter Portal
Oracle WebCenter Sites
Siebel Apps - Field Service
Oracle Retail Customer Management and Segmentation Foundation
openEuler
Fedora
pdfbox-tools
pdfbox-parent
pdfbox-reactor
pdfbox
xmpbox
fontbox
preflight
pdfbox-javadoc
pdfbox-debugger

Install updates from vendor's website.

PDFBox - update to 2.0.24
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 4.0.2
Infrastructure Technology - update to 11.2.8.0
Oracle FLEXCUBE Universal Banking - update to 14.3.0
IBM Watson Compare and Comply for IBM Cloud Pak for Data - update to 1.1.13
IBM Security Risk Manager - update to 1.8.0.0
pdfbox-tools - update to 2.0.24-1
pdfbox-parent - update to 2.0.24-1
pdfbox-reactor - update to 2.0.24-1
pdfbox - update to 2.0.24-1
xmpbox - update to 2.0.24-1
fontbox - update to 2.0.24-1
preflight - update to 2.0.24-1
pdfbox-javadoc - update to 2.0.24-1
pdfbox-debugger - update to 2.0.24-1
pdfbox - addressed in versions 2.0.24-1.fc33, 2.0.24-1.fc34

• https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e%40%3Cusers.pdfbox.apache.org%3E
• https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e@%3Cusers.pdfbox.apache.org%3E
• https://lists.apache.org/thread.html/rf251f6c358087107f8c23473468b279d59d50a75db6b4768165c78d3@%3Cannounce.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/06/12/1
• https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E
• https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E

• Denial of service in Apache PDFBox
• IBM Watson Discovery for IBM Cloud Pak for Data update for Apache PDFBox
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Treasury Management
• Multiple vulnerabilities in Oracle Banking Trade Finance
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Hyperion Infrastructure Technology
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Infinite loop in Siebel Apps - Field Service
• Multiple vulnerabilities in IBM Watson Compare and Comply for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in IBM FileNet Content Manager
• Multiple vulnerabilities in IBM DataQuant for z/OS
• Multiple vulnerabilities in Oracle Communications Messaging Server
• Multiple vulnerabilities in IBM Security Risk Manager on CP4S
• Multiple vulnerabilities in Oracle WebCenter Sites
• openEuler 20.03 LTS SP1 update for pdfbox
• Fedora 34 update for pdfbox
• Fedora 33 update for pdfbox