[IT-SecNots] [Security-news] Entity Print - Moderately critical - Multiple: Remote Code Execution, Information disclosure - SA-CONTRIB-2022-048

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2022-048

Project: Entity Print [1]
Date: 2022-July-13
Security risk: *Moderately critical* 13∕25
AC:Complex/A:User/CI:Some/II:Some/E:Proof/TD:Default [2]
Vulnerability: Multiple: Remote Code Execution, Information disclosure

Description: 
This module enables you to generate print versions of content.
Some installations of the module make use of the dompdf/dompdf third-party
dependency.
Security vulnerabilities exist for versions of dompdf/dompdf < 2.0.0

See the library release notes for more detail:
https://github.com/dompdf/dompdf/releases/tag/v2.0.0 [3]

.... Note on 3rd party vulnerabilities

This security advisory corresponds to a 3rd party vulnerability. Normally the
Drupal Security Team would not issue advisories related to 3rd party code
that is shipped separately from a module per our policy (most recent update
is PSA-2019-09-04 [4]). In this case, because the module required a specific
version and could not be updated without a change to the Drupal module we do
issue an advisory.

Solution: 
Install the latest version (8.x-2.6 [5]) of this module and update
dompdf/dompdf at the same time. It is recommended to use composer to do the
update using commands similar to the following:

composer update drupal/entity_print
composer require dompdf/dompdf:~2
Reported By: 
  * szato [6]
  * Munavir P k [7]

Fixed By: 
  * Lee Rowlands [8] of the Drupal Security Team
  * Carlos Santana [9]
  * Manoj Selvan [10]

Coordinated By: 
  * Lee Rowlands [11] of the Drupal Security Team
  * Greg Knaddison [12] of the Drupal Security Team


[1] https://www.drupal.org/project/entity_print
[2] https://www.drupal.org/security-team/risk-levels
[3] https://github.com/dompdf/dompdf/releases/tag/v2.0.0
[4] https://www.drupal.org/psa-2019-09-04
[5] https://www.drupal.org/project/entity_print/releases/8.x-2.6
[6] https://www.drupal.org/user/389677
[7] https://www.drupal.org/user/3604066
[8] https://www.drupal.org/user/395439
[9] https://www.drupal.org/user/1781526
[10] https://www.drupal.org/user/3693487
[11] https://www.drupal.org/user/395439
[12] https://www.drupal.org/user/36762

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news