Bug 13295

Summary:	[CVE 21] pdfbox 2.0.19 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	critical
Priority:	High	CC:	a.proklov, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	2021.1 Fresh R12
Hardware:	All
OS:	Linux
URL:	CVE-2021-27807, CVE-2021-27906, CVE-2021-31811, CVE-2021-31812,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-05-03 18:01:45 MSK

Please patch CVEs for package pdfbox version 2.0.19
  
INFO (CVEs are): pdfbox 2.0.19
 cves found
CVE-2021-27807
Desc: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-27807
Severity: MEDIUM
CVE-2021-27906
Desc: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-27906
Severity: MEDIUM
CVE-2021-31811
Desc: In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-31811
Severity: MEDIUM
CVE-2021-31812
Desc: In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-31812
Severity: MEDIUM

Comment 1 Svyatoslav Matveev 2023-05-26 15:39:31 MSK

********** QA ADVISORY **********

Cve закрыты обновлением проекта.

*** pdfbox
**  2.0.19 -> 2.0.24

https://abf.io/build_lists/4445653
https://abf.io/build_lists/4445652

Comment 2 Dmitry Postnikov 2023-05-30 14:18:59 MSK

***************************
The update sent to testings

Comment 3 Vladimir Potapov 2023-05-31 09:31:07 MSK

pdfbox-2.0.24-1
https://abf.io/build_lists/4445653
https://abf.io/build_lists/4445652
************************** Advisory *********************
 2.0.19 -> 2.0.24 for CVEs fix
*********************************************************
QA Verified

Comment 4 Yury 2023-07-26 17:28:08 MSK

Secteam Verified