The following vulnerabilities occurs after the dependency check scan:
CVE-2022-24196,CVE-2022-24197
Itextpdf version：
<dependency>
<groupId>com.itextpdf</groupId>
<artifactId>itextpdf</artifactId>
<version>5.5.13.4</version>
</dependency>
<dependency>
<groupId>com.itextpdf</groupId>
<artifactId>itext-asian</artifactId>
<version>5.2.0</version>
</dependency>
<dependency>`your text`
<groupId>com.itextpdf.tool</groupId>
<artifactId>xmlworker</artifactId>
<version>5.5.13.4</version>
</dependency>
I have tried to upgrade itextpdf to 5.5.13.4, but the question still remains, will the official fix this vulnerability for itextpdf5?
linhuan is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
4
The NIST report can be difficult to interpret. For example https://nvd.nist.gov/vuln/detail/CVE-2022-24197 says:
iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component
ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
(Note: v7.1.17!)
The “Known Affected Software Configurations” section says:
Configuration 1 (hide)
cpe:2.3:a:itextpdf:itext::::::::
Show Matching CPE(s) Up to (excluding) 7.2.2
But when you open the Matching CPE(s) you get this list:
cpe:2.3:a:itextpdf:itext:1.0.0:*:*:*:*:*:*:* ... cpe:2.3:a:itextpdf:itext:5.5.12:*:*:*:*:*:*:* cpe:2.3:a:itextpdf:itext:5.5.13:*:*:*:*:*:*:* cpe:2.3:a:itextpdf:itext:5.5.13.1:*:*:*:*:*:*:* cpe:2.3:a:itextpdf:itext:7.0.0:*:*:*:*:*:*:* ... cpe:2.3:a:itextpdf:itext:7.2.1:*:*:*:*:*:*:*
Notice that versions 5.5.13.2 through 5.5.13.4 are not on that NIST list. By contrast, the Maven Repository report says that 5.5.13.2 is vulnerable, but 5.5.13.3 and 5.5.13.4 are not.
So what does that mean?
Well, I think that it means that information about the status of 5.5.13.2 through 5.5.13.4 has not been provided to NIST.
The vulnerability scanner you use is presumably basing its checks solely on the version numbers listed in NIST. Since NIST doesn’t say that 5.5.13.3 and 5.5.13.4 are not vulnerable … and they are less than 7.2.2 … the checker is assuming that they are vulnerable.
In short. NIST’s information appears to be out of date for that CVE and 5.5.x versions, and this results in a false positive in your case.
But if you really want to be sure, you should research the vulnerability yourself, and check the source code repositories for iText to figure out which 5.5.x release actually contains the fix.
Or update your application to use iText 8 … which you will probably need to do at some point anyway, since iText 5 is end of life. (Eventually, the developers may decide to stop providing security updates for iText 5.)
1