PT-2021-18202 · Pypi+1 · Pikepdf+1

Eric Therond · Published 2021-04-01 · Updated 2025-12-12 · CVE-2021-29421

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: pikepdf versions 1.3.0 through 2.9.2

Description: The issue allows XXE (XML External Entity) attacks when parsing XMP metadata entries in the models/metadata.py file of the pikepdf package for Python. This occurs due to improper handling of XML external entities, potentially leading to data exposure or other security issues.

Recommendations: For pikepdf versions 1.3.0 through 2.9.2, update to a version that contains a fix for this issue to prevent XXE attacks when parsing XMP metadata entries. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

ALT-PU-2021-2030

CVE-2021-29421

GHSA-CCGM-3XW4-H5P8

MGASA-2021-0268

OPENSUSE-SU-2024:11250-1

OPENSUSE-SU-2024:13864-1

PYSEC-2021-34

Affected Products

Alt Linux

Pikepdf

References · 24

• https://github.com/pikepdf/pikepdf/commit/3f38f73218e5e782fe411ccbb3b44a793c0b343a · Patch
• https://osv.dev/vulnerability/CVE-2021-29421 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-29421 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29421 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29421 · Security Note
• https://osv.dev/vulnerability/GHSA-ccgm-3xw4-h5p8 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-34 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0268.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-29421 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0268 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG · Vendor Advisory