En resumen
- CVE-2024-28184 es una vulnerabilidad ALTO (CVSS 7.4) que afecta a weasyprint, weasyprint (kozea).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.74%, mayor que el 54.7% de las vulnerabilidades.
- Solución: actualizar a 61.2 o posterior.
| Package | Affected versions | Patched versions |
|---|
| weasyprint PyPI | ≥ 61.0, < 61.2
| 61.2
|
| weasyprint | ≥ 61.0, < 61.2
| 61.2
|
Description
Impact
Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.
Patches
Fixed by 734ee8e that’s included in 61.2
Workarounds
- Check that no PDF attachment is defined in source HTML.
- Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
NVD description
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free