Опубликовано: 20 апр. 2021
Источник: github
Github: Прошло ревью
CVSS4: 8.7
CVSS3: 7.5
Описание
Improper Restriction of XML External Entity Reference in pikepdf
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2021-29421
- https://github.com/pikepdf/pikepdf/commit/3f38f73218e5e782fe411ccbb3b44a793c0b343a
- https://github.com/advisories/GHSA-ccgm-3xw4-h5p8
- https://github.com/pypa/advisory-database/tree/main/vulns/pikepdf/PYSEC-2021-34.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ
Пакеты
Наименование
pikepdf
pip
Затронутые версииВерсия исправления
>= 1.3.0, < 2.10.0
2.10.0
Связанные уязвимости
CVSS3: 7.5
ubuntu
больше 5 лет назад
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
CVSS3: 7.5
redhat
больше 5 лет назад
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
CVSS3: 7.5
nvd
больше 5 лет назад
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
CVSS3: 7.5
debian
больше 5 лет назад
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Pyth ...
CVSS3: 7.5
altlinux
больше 5 лет назад
ALT-PU-2021-2030: package `python3-module-pikepdf` update to version 2.12.2-alt1