Command injection in itext7-core

严重 9.8CVE-2021-43113 · GHSA-gv87-q66h-4277 · Published 15/12/2021 · updated 17/06/2026

要点

CVE-2021-43113 是影响 com.itextpdf:itext7-core, com.itextpdf:itextpdf, itext (itextpdf) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：5.4%，高于 92.7% 的漏洞。
修复：升级到 7.1.17, 5.5.13.3 或更高版本。

Package	Affected versions	Patched versions
com.itextpdf:itext7-core Maven	`< 7.1.17`	`7.1.17`
com.itextpdf:itextpdf Maven	`< 5.5.13.3`	`5.5.13.3`
itext itextpdf	`≥ 7.0.0, < 7.1.17`	`7.1.17`

Description

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

NVD description

iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

References

nvd.nist.gov/vuln/detail/CVE-2021-43113 · ADVISORY
itext/itext7 · PACKAGE
itext/itext7 release 7.1.17 · WEB
itext/itextpdf release 5.5.13.3 · WEB
lists.debian.org/debian-lts-announce/2023/01/msg00013.html · WEB
pastebin.com/BXnkY9YY · WEB
debian.org/security/2023/dsa-5323 · WEB

com.itextpdf:itext7-core 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.itextpdf:itext7-core

Maven

< 7.1.17

7.1.17

com.itextpdf:itextpdf

Maven

< 5.5.13.3

5.5.13.3

itext

itextpdf

≥ 7.0.0, < 7.1.17

7.1.17

Description

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

NVD description

iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

com.itextpdf:itext7-core 的其他漏洞

查看全部 →