Critical SSL Configuration Vulnerability in TCPDF Package
Summary
CVE-2024-56521: An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. Affects tcpdf versions < aab43ab0a824e956276141a28a24c7c0be20f554. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TCPDF is an open-source PHP library that allows users to generate PDF documents directly from PHP code. It is widely used for creating dynamic PDF files in web applications. The library supports various features such as text, images, and graphics, making it a versatile tool for developers. However, prior to version 6.8.0, TCPDF had a significant vulnerability related to SSL configuration when using libcurl, which could compromise the security of applications relying on this library.
Vulnerability Detail
An issue was discovered in TCPDF before version 6.8.0, where the SSL options CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER were set unsafely when using libcurl. This misconfiguration could allow attackers to perform man-in-the-middle attacks, intercepting and altering communications between the client and server. The vulnerability poses a risk to the confidentiality and integrity of data transmitted over SSL/TLS connections.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, consider implementing the following workaround:
- Review your application code to ensure that CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are explicitly set to secure values.
- Set CURLOPT_SSL_VERIFYHOST to 2 and CURLOPT_SSL_VERIFYPEER to true in your cURL requests.
Example code snippet:
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://example.com');
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_exec($ch);
curl_close($ch);
Conclusion
The TCPDF package has a critical vulnerability related to SSL configuration when using libcurl, which could expose applications to security risks. It is crucial to update to version 6.8.0 or later to mitigate these risks. If immediate updates are not possible, ensure that SSL options are configured securely in your code.
See every vulnerability recorded for tcpdf →
FAQ
TCPDF is an open-source PHP library used for generating PDF documents from PHP code.
The vulnerability involves unsafe SSL configuration when using libcurl, which can lead to man-in-the-middle attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Implement the workaround by ensuring that CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set to secure values in your cURL requests.
Yes, the vulnerability is patched in TCPDF version 6.8.0 and later.
References
Related vulnerabilities
Recent vulnerabilities recorded for tcpdf.
