{"id":"CVE-2019-0228","details":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.","aliases":["GHSA-c9jj-3wvg-q65h"],"modified":"2026-07-08T05:53:21.391351413Z","published":"2019-04-17T15:29:00.703Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.0.0"},{"last_affected":"8.2.4.0"}],"source":"CPE_RANGE","vendor_product":"oracle:communications_session_report_manager"},{"vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"29"},{"last_affected":"29"},{"introduced":"30"},{"last_affected":"30"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"14.2"},{"last_affected":"14.2"},{"introduced":"14.3"},{"last_affected":"14.3"},{"introduced":"14.5"},{"last_affected":"14.5"}],"source":"CPE_STRING","vendor_product":"oracle:banking_corporate_lending_process_management","cpes":["cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"14.2"},{"last_affected":"14.2"},{"introduced":"14.3"},{"last_affected":"14.3"},{"introduced":"14.5"},{"last_affected":"14.5"}],"source":"CPE_STRING","vendor_product":"oracle:banking_credit_facilities_process_management","cpes":["cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*"]},{"vendor_product":"oracle:banking_supply_chain_finance","cpes":["cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.2"},{"last_affected":"14.2"},{"introduced":"14.3"},{"last_affected":"14.3"},{"introduced":"14.5"},{"last_affected":"14.5"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:banking_trade_finance_process_management","cpes":["cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.2"},{"last_affected":"14.2"},{"introduced":"14.3"},{"last_affected":"14.3"},{"introduced":"14.5"},{"last_affected":"14.5"}]},{"vendor_product":"oracle:banking_virtual_account_management","cpes":["cpe:2.3:a:oracle:banking_virtual_account_management:14.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.2"},{"last_affected":"14.2"},{"introduced":"14.3.0"},{"last_affected":"14.3.0"},{"introduced":"14.5"},{"last_affected":"14.5"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:communications_messaging_server","cpes":["cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*","cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.1"},{"last_affected":"8.1"},{"introduced":"8.1"},{"last_affected":"8.1"}]},{"cpes":["cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*","cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.1.2.4"},{"last_affected":"11.1.2.4"},{"introduced":"11.2.6.0"},{"last_affected":"11.2.6.0"}],"source":"CPE_STRING","vendor_product":"oracle:hyperion_financial_reporting"},{"extracted_events":[{"introduced":"8.58"},{"last_affected":"8.58"},{"introduced":"8.59"},{"last_affected":"8.59"}],"source":"CPE_STRING","vendor_product":"oracle:peoplesoft_enterprise_peopletools","cpes":["cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.0.6"},{"last_affected":"16.0.6"},{"introduced":"17.0"},{"last_affected":"17.0"},{"introduced":"18.0.3"},{"last_affected":"18.0.3"}],"source":"CPE_STRING","vendor_product":"oracle:retail_xstore_point_of_service"},{"cpes":["cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.2.1.3.0"},{"last_affected":"12.2.1.3.0"},{"introduced":"12.2.1.4.0"},{"last_affected":"12.2.1.4.0"}],"source":"CPE_STRING","vendor_product":"oracle:webcenter_sites"}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79%40%3Cusers.pdfbox.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c%40%3Ccommits.tika.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd%40%3Cserver-dev.james.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4%40%3Ccommits.tika.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d%40%3Cusers.pdfbox.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r32b8102392a174b17fd19509a9e76047f74852b77b7bf46af95e45a2%40%3Cserver-dev.james.apache.org%3E"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/"},{"type":"ADVISORY","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/james-project","events":[{"introduced":"e91d305cc679c4b538ada105732b5d235c0079db"},{"last_affected":"056af8c6a7c4c0e15065ea0f01e482fe1b839f6e"}],"database_specific":{"extracted_events":[{"introduced":"3.3.0"},{"last_affected":"3.3.0"},{"introduced":"3.4.0"},{"last_affected":"3.4.0"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:apache:james:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:apache:james:3.4.0:*:*:*:*:*:*:*"]}}],"versions":["3.3.0","3.4.0","james-project-3.4.0","james-project-3.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-0228.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/apache/pdfbox","events":[{"introduced":"983a4af646dd88a99f166632b9acb82b65cf1f4b"},{"last_affected":"983a4af646dd88a99f166632b9acb82b65cf1f4b"}],"database_specific":{"extracted_events":[{"introduced":"2.0.14"},{"last_affected":"2.0.14"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:apache:pdfbox:2.0.14:*:*:*:*:*:*:*"}}],"versions":["2.0.14"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-0228.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}