{
"id": "GHSA-c9jj-3wvg-q65h",
"aliases": [
"CVE-2019-0228"
],
"details": "Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.",
"summary": "Vulnerability that affects org.apache.pdfbox:pdfbox",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.14"
},
{
"fixed": "2.0.15"
}
]
}
],
"package": {
"name": "org.apache.pdfbox:pdfbox",
"ecosystem": "Maven"
}
}
],
"modified": "2021-06-15T17:00:24Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"published": "2019-07-05T21:12:54Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0228",
"type": "ADVISORY"
},
{
"url": "https://github.com/advisories/GHSA-c9jj-3wvg-q65h",
"type": "ADVISORY"
},
{
"url": "https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79@%3Cusers.pdfbox.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c@%3Ccommits.tika.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd@%3Cserver-dev.james.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4@%3Ccommits.tika.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d@%3Cusers.pdfbox.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r32b8102392a174b17fd19509a9e76047f74852b77b7bf46af95e45a2@%3Cserver-dev.james.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.fedoraproject.org/archives/list/[email protected] /message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ",
"type": "WEB"
},
{
"url": "https://lists.fedoraproject.org/archives/list/[email protected] /message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX",
"type": "WEB"
},
{
"url": "https://www.oracle.com//security-alerts/cpujul2021.html",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"severity": "CRITICAL",
"github_reviewed": true,
"nvd_published_at": "2019-04-17T15:29:00Z",
"github_reviewed_at": "2020-06-16T21:30:58Z"
}
}