What is GHSA-gv87-q66h-4277?

GHSA-gv87-q66h-4277 is a security advisory published by GitHub Security Advisories with Critical severity. Command injection in itext7-core

Which CVE IDs does GHSA-gv87-q66h-4277 cover?

GHSA-gv87-q66h-4277 covers the following CVE IDs: CVE-2021-43113. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gv87-q66h-4277?

GHSA-gv87-q66h-4277 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-gv87-q66h-4277?

GHSA-gv87-q66h-4277 affects 2 products, including: maven/com.itextpdf:itext7-core:\u003c 7.1.17; maven/com.itextpdf:itextpdf:\u003c 5.5.13.3.

GHSA-gv87-q66h-4277CriticalCVSS 9.8

Command injection in itext7-core

Vendor

GitHub Security Advisories

Published

December 16, 2021

Last Modified

March 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-43113 →

📋 Description

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

🎯 Affected products2

maven/com.itextpdf:itext7-core:< 7.1.17
maven/com.itextpdf:itextpdf:< 5.5.13.3

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2021-43113
https://github.com/itext/itext7/releases/tag/7.1.17
https://pastebin.com/BXnkY9YY
https://lists.debian.org/debian-lts-announce/2023/01/msg00013.html
https://www.debian.org/security/2023/dsa-5323
https://github.com/itext/itextpdf/releases/tag/5.5.13.3
https://github.com/advisories/GHSA-gv87-q66h-4277