GitHub Advisoryadvisory · Packagist

GHSA-9mgx-552f-59p6 TCPDF missing certificate validation

HIGH Published 2024-12-27 Modified 2024-12-27 Official page ↗

Aliases: CVE-2024-56521
Ecosystem: Packagist
Packages: tecnickcom/tcpdf
Severity: High
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-295
Reviewed: 2024-12-27

Affected packages

• Packagist tecnickcom/tcpdf: < 6.8.0 → fixed in 6.8.0

Description

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

Related

Alias · CVE (1)

CVE-2024-56521 An issue was discovered in TCPDF before 6.8.0. vulnerability

Weakness · CWE (1)

CWE-295 Improper Certificate Validation weakness

References