GHSA-35jj-wx47-4w8r

Source

https://github.com/advisories/GHSA-35jj-wx47-4w8r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-35jj-wx47-4w8r/GHSA-35jj-wx47-4w8r.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-35jj-wx47-4w8r

Aliases

CVE-2024-28184

Published

2024-03-08T20:42:52Z

Modified

2024-03-23T03:45:49.511312Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator

Summary

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

Details

Impact

Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.

Patches

Fixed by 734ee8e that’s included in 61.2

Workarounds

Check that no PDF attachment is defined in source HTML.
Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.

Database specific

{
    "nvd_published_at": "2024-03-09T01:15:07Z",
    "cwe_ids": [
        "CWE-829"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-08T20:42:52Z"
}

References

Affected packages

PyPI / weasyprint

Package

Name: weasyprint; View open source insights on deps.dev
Purl: pkg:pypi/weasyprint

Affected ranges

Type: ECOSYSTEM
Events: Introduced

61.0

Fixed

61.2

Affected versions

61.*

61.0

61.1

Database specific

{
    "last_known_affected_version_range": "<= 61.1"
}