Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-3902 →
DEBIAN-CVE-2021-3902
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deser...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
php-dompdf
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org