CVE-2022-24198: 
Java vulnerability analysis and mitigation

iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a potential Denial of Service (DoS) via a crafted PDF file. The vulnerability was reported in February 2022 and is tracked as CVE-2022-24198 (NVD).

The vulnerability manifests as an ArrayIndexOutOfBoundsException in the ARCFOUREncryption.encryptARCFOUR component. The issue was identified in multiple components including StandardHandlerUsingStandard128.computeOwnerKey, PdfXrefTable.clear, PdfXrefTable.get, and PdfXrefTable.initFreeReferencesList (GitHub PR).

While initially reported as a potential Denial of Service vulnerability, the vendor has disputed this classification. The vendor acknowledges that the code can trigger an ArrayIndexOutOfBoundsException but maintains that this does not constitute a security vulnerability as Java inherently protects against buffer overflow attacks (GitHub Comment).

The vendor acknowledges that the library could handle invalid input better but disputes this as a security vulnerability. They have indicated openness to improvements in exception handling but have not issued a specific security patch as they do not consider this a security issue (GitHub Comment).

The security community appears divided on this issue. While it was initially assigned a CVE identifier, the vendor has disputed its classification as a security vulnerability. This has led to discussions about what constitutes a security vulnerability versus a programming error (GitHub PR).