DRUPAL-CONTRIB-2022-048 This module enables you to generate print versions of content.
Vulnerabilities in the dompdf library used by the Drupal print module allow attackers to execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not stated
- Fix
- Available
What is DRUPAL-CONTRIB-2022-048?
DRUPAL-CONTRIB-2022-048 is a vulnerability in drupal/entity_print, published on 13 Jul 2022. It can be exploited over the network.
Official description
This module enables you to generate print versions of content.
Some installations of the module make use of the dompdf/dompdf third-party dependency.
Security vulnerabilities exist for versions of dompdf/dompdf < 2.0.0
See the library release notes for more detail: <https://github.com/dompdf/dompdf/releases/tag/v2.0.0>
Note on 3rd party vulnerabilities
This security advisory corresponds to a 3rd party vulnerability. Normally the Drupal Security Team would not issue advisories related to 3rd party code that is shipped separately from a module per our policy (most recent update is PSA-2019-09-04). In this case, because the module required a specific version and could not be updated without a change to the Drupal module we do issue an advisory.
Which versions are affected by DRUPAL-CONTRIB-2022-048?
Linux distribution packages (1)
drupal/entity_print Packagist:https://packages.drupal.org/8 | All versions | 2.6.0 |
How do I fix DRUPAL-CONTRIB-2022-048?
Upgrade to a fixed version.
Is DRUPAL-CONTRIB-2022-048 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-048 in the wild and no public exploit code.