In breve
- CVE-2024-28184 è una vulnerabilità ALTO (CVSS 7.4) che riguarda weasyprint, weasyprint (kozea).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.74%, superiore al 54.7% delle vulnerabilità.
- Correzione: aggiornare a 61.2 o successiva.
| Package | Affected versions | Patched versions |
|---|
| weasyprint PyPI | ≥ 61.0, < 61.2
| 61.2
|
| weasyprint | ≥ 61.0, < 61.2
| 61.2
|
Description
Impact
Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.
Patches
Fixed by 734ee8e that’s included in 61.2
Workarounds
- Check that no PDF attachment is defined in source HTML.
- Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
NVD description
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free