CVE-2024-22640: TCPDF Regular Expression Denial of Service
Summary
CVE-2024-22640: TCPDF vulnerable to Regular Expression Denial of Service. Affects tecnickcom/tcpdf versions < 6.7.5. Fixed in 6.7.5. How to fix ↓
Also tracked for
- tcpdf · Debian:11
The same CVE-2024-22640 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TCPDF is an open-source PHP library for generating PDF documents. It provides various functionalities for creating and manipulating PDF files. However, versions up to 6.7.4 of TCPDF are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing untrusted HTML pages with a crafted color.
Vulnerability Detail
The vulnerability in TCPDF arises from a lack of proper input validation when processing HTML pages. An attacker can exploit this by providing a specially crafted color value, triggering a ReDoS attack. This can lead to a denial of service condition, where the application becomes unresponsive or crashes. The vulnerability has a moderate severity rating and is identified by the Common Weakness Enumeration (CWE) ID 1333.
How To Fix
Minimum fixed version
6.7.5
This is the first release that contains the fix.
composer require tecnickcom/tcpdf:6.7.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is essential to update TCPDF to a patched version to mitigate the risk of exploitation.
Conclusion
TCPDF version <=6.7.4 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. It is crucial to update TCPDF to a patched version to mitigate the risk of exploitation. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tecnickcom/tcpdf →
FAQ
TCPDF is a PHP library for generating PDF documents.
ReDoS is a type of Denial of Service attack that exploits inefficient regular expressions, causing the application to consume excessive resources and become unresponsive.
The vulnerability in TCPDF can lead to a denial of service condition, where the application becomes unresponsive or crashes.
To fix this vulnerability, update TCPDF to a version higher than 6.7.4, which includes a patch for the ReDoS vulnerability.
No, there is currently no known workaround for this vulnerability. Updating TCPDF is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for tecnickcom/tcpdf.
