PT-2021-23745 · Itext+1 · Itext+1

Gabriele Zuddas · Published 2021-12-15 · Updated 2026-02-25 · CVE-2021-43113

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iText versions prior to 7.1.17

Description The issue allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java. This can occur when a malicious filename is provided to the CompareTool, potentially leading to the execution of arbitrary commands.

Recommendations For versions prior to 7.1.17, update to version 7.1.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the GhostscriptHelper.java class or disabling the CompareTool functionality until a patch is applied. Avoid using potentially malicious filenames with the CompareTool to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-43113

DLA-3273-1

DSA-5323-1

GHSA-GV87-Q66H-4277

OPENSUSE-SU-2024:11980-1

Affected Products

Ghostscript

Itext

References · 21

• 🔥 https://pastebin.com/BXnkY9YY · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-43113 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43113 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43113 · Security Note
• https://debian.org/security/2023/dsa-5323 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3273-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gv87-q66h-4277 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-43113 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-43113 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5323-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-43113 · Security Note
• https://github.com/itext/itext7/releases/tag/7.1.17 · Note
• https://github.com/itext/itext7 · Note
• https://github.com/itext/itextpdf/releases/tag/5.5.13.3 · Note