PT-2024-22267 · Unknown · Verapdf-Library

Carlwilson · Published 2024-03-28 · Updated 2024-05-20 · CVE-2024-28109

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions veraPDF-library versions prior to 1.24.2

Description The veraPDF-library, a PDF/A validation library, has a remote code execution (RCE) vulnerability when executing policy checks using custom schematron files. This invokes an XSL transformation that could lead to RCE. Most users are not affected as they do not insert custom XSLT code into policy profiles. For users who do, it is recommended to only load custom policy files from trusted sources.

Recommendations For versions prior to 1.24.2, upgrade to version 1.24.2 to fix the vulnerability. As a temporary workaround, consider only loading custom policy files from sources you trust, to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2024-28109

GHSA-QXQF-2MFX-X8JW

Affected Products

Verapdf-Library

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28109.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28109 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28109 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qxqf-2mfx-x8jw · Vendor Advisory
• https://github.com/veraPDF/veraPDF-library · Note
• https://github.com/veraPDF/veraPDF-library/issues/1415 · Note
• https://github.com/veraPDF/veraPDF-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb · Note
• https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-qxqf-2mfx-x8jw · Note
• https://github.com/veraPDF/veraPDF-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe · Note
• https://github.com/veraPDF/veraPDF-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f · Note
• https://t.me/cvenotify/74998 · Telegram Post
• https://twitter.com/CVEnew/status/1773341061621969246 · Twitter Post