Threats affecting pkg:github/verapdf/veraPDF-validation

veraPDF-validation versions from 1.25.73 up to but not including 1.30.2, and versions before 1.31.71, contain an XML External Entity (XXE) vulnerability. This vulnerability exists in the PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender() functions, where XML parsing of rich-text annotations, form-field values, and XFA configurations in untrusted PDFs can lead to local file disclosure and outbound network requests. The issue is fixed in versions 1.30.2 and 1.31.71.

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.