Em resumo
- CVE-2024-28184 é uma vulnerabilidade ALTO (CVSS 7.4) que afeta weasyprint, weasyprint (kozea).
- Chance de exploração nos próximos 30 dias (EPSS): 0.74%, maior que 54.7% das vulnerabilidades.
- Correção: atualize para 61.2 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| weasyprint PyPI | ≥ 61.0, < 61.2
| 61.2
|
| weasyprint | ≥ 61.0, < 61.2
| 61.2
|
Description
Impact
Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.
Patches
Fixed by 734ee8e that’s included in 61.2
Workarounds
- Check that no PDF attachment is defined in source HTML.
- Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
NVD description
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free