logo

Database

Local file inclusion In dompdf/dompdf

Description

Dompdf allows remote file inclusion because URI validation failure does not halt font registration registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-413432. NVD-2022-413433. OSV-2022-413434. GHSA-6x28-7h8c-chx45. GCVE-2022-41343

References

1. https://github.com/dompdf/dompdf/issues/29942. https://github.com/dompdf/dompdf/pull/29953. https://github.com/dompdf/dompdf/commit/66431c58017d5b1bdb9f6f772b9fbbc5e3d38dc24. https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-41343.yaml5. https://github.com/dompdf/dompdf/releases/tag/v2.0.16. https://tantosec.com/blog/cve-2022-413437. https://github.com/BKreisel/CVE-2022-41343

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.