REDHAT-BUG-2448547: High severity jsPDF jsPDF vulnerability
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the createAnnotation: color parameter. The vulnerability has been fixed in jsPDF.1. As a workaround, sanitize user input before passing it to the vulnerable API members.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsPDF.1to a version that resolves this vulnerability.Fixed in 4.2.1 - Compensating control
Sanitize user input before passing it to the vulnerable API method `createAnnotation`, specifically for the `color` parameter (and any other arguments) to prevent injection of arbitrary PDF objects such as JavaScript actions.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2448547?
The severity of REDHAT-BUG-2448547 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2448547?
To fix REDHAT-BUG-2448547, upgrade jsPDF to version 4.2.1 or later.
What is the risk associated with REDHAT-BUG-2448547?
The risk associated with REDHAT-BUG-2448547 is rated at 33, indicating a significant potential impact.
What is the main issue with REDHAT-BUG-2448547?
The main issue with REDHAT-BUG-2448547 is that it allows injection of arbitrary PDF objects through unsanitized user input in the createAnnotation method.
Which library is affected by REDHAT-BUG-2448547?
The library affected by REDHAT-BUG-2448547 is jsPDF.