What is GHSA-6x28-7h8c-chx4?

GHSA-6x28-7h8c-chx4 is a security advisory published by GitHub Security Advisories with High severity. Dompdf allows remote file inclusion because URI validation failure does not halt font registration

Which CVE IDs does GHSA-6x28-7h8c-chx4 cover?

GHSA-6x28-7h8c-chx4 covers the following CVE IDs: CVE-2022-41343. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6x28-7h8c-chx4?

GHSA-6x28-7h8c-chx4 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-6x28-7h8c-chx4?

GHSA-6x28-7h8c-chx4 affects 1 product, including: composer/dompdf/dompdf:\u003c 2.0.1.

GHSA-6x28-7h8c-chx4HighCVSS 7.5

Dompdf allows remote file inclusion because URI validation failure does not halt font registration

Vendor

GitHub Security Advisories

Published

September 26, 2022

Last Modified

February 5, 2024

🔗 CVE IDs covered (1)

CVE-2022-41343 →

📋 Description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

🎯 Affected products1

composer/dompdf/dompdf:< 2.0.1

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2022-41343
https://github.com/dompdf/dompdf/issues/2994
https://github.com/dompdf/dompdf/pull/2995
https://github.com/dompdf/dompdf/releases/tag/v2.0.1
https://github.com/dompdf/dompdf/commit/66431c58017d5b1bdb9f6f772b9fbbc5e3d38dc2
https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-41343.yaml
https://github.com/advisories/GHSA-6x28-7h8c-chx4
https://tantosec.com/blog/cve-2022-41343/