CVE-2018-17057: TCPDF vulnerable to attackers triggering deserialization of arbitrary data
Summary
CVE-2018-17057: TCPDF vulnerable to attackers triggering deserialization of arbitrary data. Affects tecnickcom/tcpdf versions < 6.2.22. Fixed in 6.2.22. How to fix ↓
Also tracked for
- tcpdf · Debian:11
The same CVE-2018-17057 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TCPDF is a popular open-source PHP library for generating PDF documents. It provides a wide range of functionality for creating and manipulating PDF files. However, versions before 6.2.22 are susceptible to a critical vulnerability that allows attackers to trigger deserialization of arbitrary data using the phar:// wrapper.
Vulnerability Detail
The vulnerability in TCPDF arises from a lack of proper input validation and sanitization. By exploiting this flaw, an attacker can craft a malicious request that triggers the deserialization of arbitrary data. This can lead to various security risks, including remote code execution, information disclosure, and unauthorized access to sensitive data. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
6.2.22
This is the first release that contains the fix.
composer require tecnickcom/tcpdf:6.2.22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of TCPDF.
Conclusion
The vulnerability in TCPDF allows attackers to trigger deserialization of arbitrary data, posing significant security risks. It is crucial to upgrade to the patched version of TCPDF (6.2.22 or later) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact the Devnack support team at DevNack.com.
See every vulnerability recorded for tecnickcom/tcpdf →
FAQ
TCPDF is an open-source PHP library for generating PDF documents. It offers a comprehensive set of features and is widely used in various web applications.
The vulnerability allows attackers to trigger deserialization of arbitrary data, which can lead to severe security risks such as remote code execution and unauthorized access to sensitive information.
To fix this vulnerability, you should upgrade TCPDF to version 6.2.22 or later. Ensure that the updated library is properly integrated into your application.
No, there is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading TCPDF.
For more information about this vulnerability, you can refer to the CVE-2018-17057 advisory or reach out to the Devnack support team at info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for tecnickcom/tcpdf.
