IBM Watson Compare and Comply for IBM Cloud Pak for Data contains a vulnerable version of Apache PDFBox.
CVEID:CVE-2021-27807
**DESCRIPTION:**Apache PDFBox is vulnerable to a denial of service, caused by an infinite loop flaw. By persuading a victim to open a specially-crafted .PDF file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/198451 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVEID:CVE-2021-27906
**DESCRIPTION:**Apache PDFBox is vulnerable to a denial of service, caused by an OutOfMemory-Exception flaw. By persuading a victim to open a specially-crafted .PDF file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/198452 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Affected Product(s) | Version(s) |
---|---|
ICP - Compare & Comply | All |
Upgrade to IBM Watson Compare and Comply for IBM Cloud Pak for Data 1.1.12. To download the software, go to Passport Advantage, then search for “watson compare and comply for ICP for Data”, then select IBM Watson Compare and Comply for ICP for Data V1.1.12 Linux English , part number G01SYEN.
None
CPE | Name | Operator | Version |
---|---|---|---|
compare and comply | eq | 1.0.0 | |
compare and comply | eq | 1.1.11 |