요약
- CVE-2024-28184은(는) weasyprint, weasyprint (kozea)에 영향을 주는 높음 (CVSS 7.4) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.74%, 전체 취약점의 54.7%보다 높음.
- 조치: 61.2 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| weasyprint PyPI | ≥ 61.0, < 61.2
| 61.2
|
| weasyprint | ≥ 61.0, < 61.2
| 61.2
|
Description
Impact
Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.
Patches
Fixed by 734ee8e that’s included in 61.2
Workarounds
- Check that no PDF attachment is defined in source HTML.
- Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
NVD description
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free