veraPDF has potential XSLT injection vulnerability when using policy files — CVE-2024-28109
GHSA · GitHub · CVE-2024-28109
CVE-2024-28109
GHSA
GitHub
high
8.1
0.01159
Summary
### Impact Executing policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. ### Patches This has been patched and users should upgrade to veraPDF v1.24.2 ### Workarounds This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT…
Product
maven: org.verapdf:core | maven: org.verapdf:core-jakarta | maven: org.verapdf:core-arlington | maven: org.verapdf:verapdf-library-arlington | maven: org.verapdf:verapdf-library | maven: org.verapdf:verapdf-library-jakarta | maven: org.verapdf:library-arlington | maven: org.verapdf:library | +1
What to do
General, cautious steps (verify details in the official source):
- Prioritize patching or mitigation immediately (treat as actively risky).
- Identify affected product versions in your inventory and verify whether you are impacted.
- Apply vendor patches/updates or recommended mitigations as soon as available.
- Read the official advisory for exact affected versions and remediation steps.