Fluid Attacks Database

Description

Command injection in itext7-core iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	com.itextpdf:itextpdf	>=0 <5.5.13.3	5.5.13.3
debian 11	libitext5-java	=5.5.13.2-1 \|\| >=0 <5.5.13.2-1+deb11u1	5.5.13.2-1+deb11u1
debian 13	libitext5-java	>=0 <5.5.13.3-1	5.5.13.3-1
debian 14	libitext5-java	>=0 <5.5.13.3-1	5.5.13.3-1
maven	com.itextpdf:itext7-core	>=0 <7.1.17	7.1.17
debian 12	libitext5-java	>=0 <5.5.13.3-1	5.5.13.3-1

Aliases

1. CVE-2021-431132. NVD-2021-431133. OSV-2021-431134. OSV-DEBIAN-2021-431135. GCVE-2021-431136. lists.debian.org7. SECURITY-TRACKER-CVE-2021-43113

References

1. https://github.com/itext/itext7/releases/tag/7.1.172. https://github.com/itext/itextpdf/releases/tag/5.5.13.33. https://pastebin.com/BXnkY9YY4. https://www.debian.org/security/2023/dsa-5323

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.