GitHub Advisoryadvisory · PyPI

GHSA-ccgm-3xw4-h5p8 Improper Restriction of XML External Entity Reference in pikepdf

HIGH Published 2021-04-20 Modified 2024-10-09 Official page ↗
Aliases
CVE-2021-29421
Ecosystem
PyPI
Packages
pikepdf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2021-04-19

Affected packages

• PyPI pikepdf: >= 1.3.0, < 2.10.0 → fixed in 2.10.0

Description

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.

Related

Alias · CVE (1)

  • CVE-2021-29421 models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References