PT-2024-22317 · Unknown · Weasyprint

Nullie · Published 2024-03-08 · Updated 2024-03-23 · CVE-2024-28184

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WeasyPrint versions 61.0 through 61.1

Description WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url fetcher is configured to prevent access to files and URLs.

Recommendations For WeasyPrint versions 61.0 through 61.1, update to version 61.2 to resolve the issue. As a temporary workaround, check that no PDF attachment is defined in source HTML. Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.

Exploit

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2024-28184

GHSA-35JJ-WX47-4W8R

Affected Products

Weasyprint

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28184.json · Exploit
• https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r · Vendor Advisory
• https://github.com/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598 · Patch
• https://ubuntu.com/security/CVE-2024-28184 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZLQZMOEDY72TS43HDXOBVID2VYCTWIH6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28184 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28184 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28184 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28184 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28184 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-35jj-wx47-4w8r · Vendor Advisory
• https://github.com/Kozea/WeasyPrint · Note
• https://t.me/cvenotify/73460 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1766365874519154701 · Twitter Post