Описание
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
There's a flaw in the pikepdf Python library's XMP metadata parsing functionality. An attacker who is able to submit a crafted PDF file to be processed by pikepdf could trigger an XML External Entity (XXE) injection. The highest threat of this flaw is to confidentiality of data.
Отчет
This flaw does not affect any Red Hat shipped commercial products, as pikepdf is not currently shipped.
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Pyth ...
Improper Restriction of XML External Entity Reference in pikepdf
ALT-PU-2021-2030: package `python3-module-pikepdf` update to version 2.12.2-alt1
7.5 High
CVSS3