CVE-2021-27807
published 2021-03-19CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
PriorityP426medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
2.99%
87.3th percentile
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | pdfbox | 2.0.0 – 2.0.22 | — |
| apache | tika | — | — |
| apache_software_foundation | apache_pdfbox | Apache PDFBox – 2.0.22 | — |
| debian | libpdfbox-java | < libpdfbox2-java 2.0.23-1 (bookworm) | libpdfbox2-java 2.0.23-1 (bookworm) |
| debian | libpdfbox2-java | < libpdfbox2-java 2.0.23-1 (bookworm) | libpdfbox2-java 2.0.23-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | banking_treasury_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | communications_messaging_server | — | — |
| oracle | communications_session_report_manager | 8.0.0 – 8.2.4.0 | — |
| oracle | flexcube_universal_banking | — | — |
| oracle | flexcube_universal_banking | 14.0.0 – 14.3.0 | — |
| oracle | hyperion_financial_reporting | — | — |
| oracle | hyperion_financial_reporting | — | — |
| oracle | hyperion_infrastructure_technology | < 11.2.8.0 | 11.2.8.0 |
| oracle | outside_in_technology | — | — |
| oracle | primavera_unifier | — | — |
| oracle | primavera_unifier | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_oracle6.5MEDIUM
vendor_apache5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Retail Applications Risk Matrix: Segment (Apache PDFbox) — CVE-2021-27807
vendor_oracle·2021-07-15·CVSS 6.5
CVE-2021-27807 [MEDIUM] Oracle Oracle Retail Applications Risk Matrix: Segment (Apache PDFbox) — CVE-2021-27807
Oracle Oracle Retail Applications Risk Matrix: Segment (Apache PDFbox) vulnerability
CVE: CVE-2021-27807
CVSS: 6.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Red Hat
pdfbox: infinite loop while loading a crafted PDF file
vendor_redhat·2021-03-19·CVSS 5.5
CVE-2021-27807 [MEDIUM] CWE-835 pdfbox: infinite loop while loading a crafted PDF file
pdfbox: infinite loop while loading a crafted PDF file
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Package: pdfbox (Red Hat BPM Suite 6) - Out of support scope
Package: pdfbox (Red Hat Integration Camel K 1) - Affected
Package: pdfbox (Red Hat Integration Camel Quarkus 1) - Not affected
Package: pdfbox (Red Hat JBoss BRMS 6) - Out of support scope
Package: pdfbox (Red Hat JBoss Data Virtualization 6) - Out of support scope
Package: pdfbox (Red Hat JBoss Fuse 6) - Out of support scope
Package: pdfbox (Red Hat JBoss Fuse Service Works 6) - Out of support scope
Debian
CVE-2021-27807: libpdfbox-java - A carefully crafted PDF file can trigger an infinite loop while loading the file...
vendor_debian·2021·CVSS 5.5
CVE-2021-27807 [MEDIUM] CVE-2021-27807: libpdfbox-java - A carefully crafted PDF file can trigger an infinite loop while loading the file...
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Apache
Apache tika: CVE-2021-27807
vendor_apache·CVSS 5.5
CVE-2021-27807 [MEDIUM] Apache tika: CVE-2021-27807
Apache tika: CVE-2021-27807
Infinite loop while loading a file in PDFBox before 2.0.23. Fabian Meumertzheim ?-1.25
OSV
Excessive Iteration Denial of Service in Apache PDFBox
osv·2021-06-16
CVE-2021-27807 [MEDIUM] Excessive Iteration Denial of Service in Apache PDFBox
Excessive Iteration Denial of Service in Apache PDFBox
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
GHSA
Excessive Iteration Denial of Service in Apache PDFBox
ghsa·2021-06-16
CVE-2021-27807 [MEDIUM] CWE-834 Excessive Iteration Denial of Service in Apache PDFBox
Excessive Iteration Denial of Service in Apache PDFBox
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
OSV
CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file
osv·2021-03-19·CVSS 5.5
CVE-2021-27807 [MEDIUM] CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2021/03/19/9https://lists.apache.org/thread.html/r043edc5dcf9199f7f882ed7906b41cb816753766e88b8792dbf319a9%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/r4717f902f8bc36d47b3fa978552a25e4ed3ddc2fffb52b94fbc4ab36%40%3Cusers.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3Ehttps://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r5c8e2125d18af184c80f7a986fbe47eaf0d30457cd450133adc235ac%40%3Ccommits.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/r6e067a6d83ccb6892d0ff867bd216704f21fb0b6a854dea34be04f12%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/r7ee634c21816c69ce829d0c41f35afa2a53a99bdd3c7cce8644fdc0e%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r9ffe179385637b0b5cbdabd0246118005b4b8232909d2d14cd68ccd3%40%3Ccommits.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/raa35746227f3f8d50fff1db9899524423a718f6f35cd39bd4769fa6c%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/rc69140d894c6a9c67a8097a25656cce59b46a5620c354ceba10543c3%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/re1e35881482e07dc2be6058d9b44483457f36133cac67956686ad9b9%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AVLKAHFMPH72TTP25INPZPGX5FODK3H/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KDA2U4KL2N3XT3PM4ZJEBBA6JJIH2G4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PT72QOFDXLJ7PLTN66EMG5EHPTE7TFZ/https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://www.openwall.com/lists/oss-security/2021/03/19/9https://lists.apache.org/thread.html/r043edc5dcf9199f7f882ed7906b41cb816753766e88b8792dbf319a9%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r1218e60c32829f76943ecaca79237120c2ec1ab266459d711a578b50%40%3Cdev.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r1d268642f8b52456ee8f876b888b8ed7a9e9568c7770789f3ded7f9e%40%3Ccommits.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/r4717f902f8bc36d47b3fa978552a25e4ed3ddc2fffb52b94fbc4ab36%40%3Cusers.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r4cbc3f6981cd0a1a482531df9d44e4c42a7f63342a7ba78b7bff8a1b%40%3Cnotifications.james.apache.org%3Ehttps://lists.apache.org/thread.html/r54594251369e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r5c8e2125d18af184c80f7a986fbe47eaf0d30457cd450133adc235ac%40%3Ccommits.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/r6e067a6d83ccb6892d0ff867bd216704f21fb0b6a854dea34be04f12%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/r7ee634c21816c69ce829d0c41f35afa2a53a99bdd3c7cce8644fdc0e%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3885c1e2db398bc55cfb%40%3Cusers.pdfbox.apache.org%3Ehttps://lists.apache.org/thread.html/r9ffe179385637b0b5cbdabd0246118005b4b8232909d2d14cd68ccd3%40%3Ccommits.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/raa35746227f3f8d50fff1db9899524423a718f6f35cd39bd4769fa6c%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/rc69140d894c6a9c67a8097a25656cce59b46a5620c354ceba10543c3%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.apache.org/thread.html/re1e35881482e07dc2be6058d9b44483457f36133cac67956686ad9b9%40%3Cnotifications.ofbiz.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AVLKAHFMPH72TTP25INPZPGX5FODK3H/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KDA2U4KL2N3XT3PM4ZJEBBA6JJIH2G4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PT72QOFDXLJ7PLTN66EMG5EHPTE7TFZ/https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-03-19
Published