First published: Wed Apr 17 2019(Updated: )
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
Credit: security@apache.org
Affected Software | Affected Version | How to fix |
---|---|---|
Apache PDFBox | =2.0.14 | |
Apache James | =3.3.0 | |
Apache James | =3.4.0 | |
Fedoraproject Fedora | =29 | |
Fedoraproject Fedora | =30 | |
Oracle Banking Corporate Lending Process Management | =14.2 | |
Oracle Banking Corporate Lending Process Management | =14.3 | |
Oracle Banking Corporate Lending Process Management | =14.5 | |
Oracle Banking Credit Facilities Process Management | =14.2 | |
Oracle Banking Credit Facilities Process Management | =14.3 | |
Oracle Banking Credit Facilities Process Management | =14.5 | |
Oracle Banking Supply Chain Finance | =14.2 | |
Oracle Banking Supply Chain Finance | =14.3 | |
Oracle Banking Supply Chain Finance | =14.5 | |
Oracle Banking Trade Finance Process Management | =14.2 | |
Oracle Banking Trade Finance Process Management | =14.3 | |
Oracle Banking Trade Finance Process Management | =14.5 | |
Oracle Banking Virtual Account Management | =14.2 | |
Oracle Banking Virtual Account Management | =14.3.0 | |
Oracle Banking Virtual Account Management | =14.5 | |
Oracle Communications Messaging Server | =8.1 | |
Oracle Communications Session Report Manager | >=8.0.0.0<=8.2.4.0 | |
Oracle Hyperion Financial Reporting | =11.1.2.4 | |
Oracle Hyperion Financial Reporting | =11.2.6.0 | |
Oracle PeopleSoft Enterprise PeopleTools | =8.58 | |
Oracle PeopleSoft Enterprise PeopleTools | =8.59 | |
Oracle Retail Xstore Point of Service | =16.0.6 | |
Oracle Retail Xstore Point of Service | =17.0 | |
Oracle Retail Xstore Point of Service | =18.0.3 | |
Oracle WebCenter Sites | =12.2.1.3.0 | |
Oracle WebCenter Sites | =12.2.1.4.0 | |
Oracle Communications Messaging Server | =8.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2019-0228 is critical with a CVSS score of 9.8.
The affected software for CVE-2019-0228 includes Apache PDFBox 2.0.14, Apache James 3.3.0 and 3.4.0, Fedoraproject Fedora 29 and 30, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management, Oracle Banking Supply Chain Finance, IBM ETM, Oracle Banking Virtual Account Management, Oracle Communications Messaging Server, Oracle Communications Session Report Manager, Oracle Hyperion Financial Reporting, Oracle PeopleSoft Enterprise PeopleTools, Oracle Retail Xstore Point of Service, and Oracle WebCenter Sites.
CVE-2019-0228 affects Apache PDFBox 2.0.14 by allowing a remote attacker to obtain sensitive information through improper handling of XML External Entity (XXE) by the XML parser.
To fix CVE-2019-0228, it is recommended to update to a patched version of the affected software or apply the necessary security patches.
The CWE ID of CVE-2019-0228 is 611.