{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.2.2"}],"component":"com.lowagie:itext","cve_ids":["CVE-2017-9096"],"ecosystem":"Maven","epss":0.09565,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-86p9-x5pw-94qx","id":"tcs_01M5N8M26T9WCR6BC3RRJSZ09P","modified_at":"2024-03-06T22:03:02.822563Z","published_at":"2022-05-13T01:14:24Z","references":["https://osv.dev/vulnerability/GHSA-86p9-x5pw-94qx","https://nvd.nist.gov/vuln/detail/CVE-2017-9096","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-017_itext_xml_external_entity_attack.txt","https://www.oracle.com/security-alerts/cpuoct2020.html","http://www.securityfocus.com/archive/1/541483/100/0/threaded"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-86p9-x5pw-94qx#Maven/com.lowagie:itext","url":"https://osv.dev/vulnerability/GHSA-86p9-x5pw-94qx"}],"summary":"Improper Restriction of XML External Entity Reference in iText"}