[GHSA-97m3-52wr-xvv2] Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

[bsweeney]

Updates

• Affected products

Comments
This advisory was informational for Dompdf users because of a vulnerability in a tight dependency (php-svg-lib) where Dompdf exposes a larger attack surface. Any version of Dompdf is no longer vulnerable once php-svg-lib is updated to the latest release.

[github]

Hi there @Blaklis and @bsweeney! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[ohader]

See comment by @bsweeney at dompdf/dompdf#3393 (comment)

@darakian @taladrane Could you please prioritize processing this change? It seems to cause some trouble in the dompdf/dompdf community currently. Thanks in advance for your support! ❤️

[bsweeney]

Note that this duplicates #3647.

[bsweeney]

Any way to make adjustments prior to merge? I just noticed that the CWEs are no longer present.

[advisory-database]

Hi @bsweeney! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[darakian]

Any way to make adjustments prior to merge? I just noticed that the CWEs are no longer present.

That's odd. We have them on our backend. Let me ask around if there's something going wrong in the pipeworks.

[bsweeney]

That's odd. We have them on our backend. Let me ask around if there's something going wrong in the pipeworks.

Maybe so. I submitted an update to add them back and noticed that the change didn't actually modify that field in the JSON because the CWE info was still there. 🤷

Thanks so much for your support.

[darakian]

Np. Turns out it was a pipeworks problem and a fix is in. You should see the CWEs on the web view now :)