Kurz gesagt
- CVE-2024-28184 ist eine Schwachstelle (HOCH (CVSS 7.4)) in weasyprint, weasyprint (kozea).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.74%, höher als bei 54.7% aller Schwachstellen.
- Abhilfe: auf 61.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| weasyprint PyPI | ≥ 61.0, < 61.2
| 61.2
|
| weasyprint | ≥ 61.0, < 61.2
| 61.2
|
Description
Impact
Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.
Patches
Fixed by 734ee8e that’s included in 61.2
Workarounds
- Check that no PDF attachment is defined in source HTML.
- Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
NVD description
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free