veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability — CVE-2024-52800
GHSA · GitHub · CVE-2024-52800
CVE-2024-52800
GHSA
GitHub
low
2.3
0.12493
Summary
### Impact Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. ### Patches We are currently working on a patch that will be released when ready. ### Workarounds This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert…
Product
maven: org.verapdf:core | maven: org.verapdf:core-jakarta | maven: org.verapdf:core-arlington | maven: org.verapdf:verapdf-library-jakarta | maven: org.verapdf:verapdf-library-arlington | maven: org.verapdf:verapdf-library | maven: org.verapdf:library | maven: org.verapdf:library-jakarta | +1
What to do
General, cautious steps (verify details in the official source):
- Review exposure and plan remediation based on risk and environment.
- Identify affected product versions in your inventory and verify whether you are impacted.
- Apply vendor patches/updates or recommended mitigations as soon as available.
- Read the official advisory for exact affected versions and remediation steps.