{"action":"Upgrade com.itextpdf:itextpdf to 5.5.12 (5.x) or 7.0.3 (7.x) or later.","affected":[{"fixed":"5.5.12","introduced":"0"},{"fixed":"7.0.3","introduced":"7.0.0"}],"component":"com.itextpdf:itextpdf","cve_ids":["CVE-2017-9096"],"ecosystem":"Maven","epss":0.09565,"exploited":false,"fixed_versions":["5.5.12","7.0.3"],"ghsa_id":"GHSA-86p9-x5pw-94qx","id":"tcs_01M5N8M219TYQWEPXR48R90EQZ","modified_at":"2024-03-06T22:03:02.822563Z","published_at":"2022-05-13T01:14:24Z","references":["https://osv.dev/vulnerability/GHSA-86p9-x5pw-94qx","https://nvd.nist.gov/vuln/detail/CVE-2017-9096","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-017_itext_xml_external_entity_attack.txt","https://www.oracle.com/security-alerts/cpuoct2020.html","http://www.securityfocus.com/archive/1/541483/100/0/threaded"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-86p9-x5pw-94qx","url":"https://osv.dev/vulnerability/GHSA-86p9-x5pw-94qx"}],"summary":"Improper Restriction of XML External Entity Reference in iText"}