Critical Vulnerabilities in php-dompdf: Security Risks and Mitigation
Summary
USN-6277-2: php-dompdf vulnerabilities. Affects php-dompdf versions < 0.6.2+dfsg-3.1ubuntu0.1. Fixed in 0.6.2+dfsg-3.1ubuntu0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php-dompdf is a popular PHP library that enables the generation of PDF documents from HTML content. It is widely used in web applications for creating dynamic reports and documents. However, vulnerabilities have been identified in this package, particularly in how it processes untrusted HTML input, which can lead to severe security risks.
Vulnerability Detail
The vulnerabilities in php-dompdf stem from improper validation of untrusted input when processing HTML content. Specifically, issues were discovered that could allow an attacker to expose sensitive information or execute arbitrary code. The vulnerabilities include the handling of PHAR file references and the bypassing of chroot checks, which can lead to deserialization of untrusted data and unauthorized access to local files.
How To Fix
Minimum fixed version
0.6.2+dfsg-3.1ubuntu0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-dompdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application does not process untrusted HTML content or restrict the use of PHAR files until the package can be updated. Additionally, consider implementing input validation and sanitization measures in your application to mitigate risks.
Conclusion
In summary, the vulnerabilities in php-dompdf pose significant security risks that can lead to unauthorized access and code execution. It is crucial to update to the latest version to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for php-dompdf →
FAQ
php-dompdf is a PHP library that converts HTML to PDF, allowing developers to generate PDF documents dynamically.
The main vulnerabilities include improper validation of untrusted HTML input, which can lead to arbitrary code execution and exposure of sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, implement strict input validation and avoid processing untrusted HTML content as a temporary measure.
More information can be found in the original advisory details and the related CVEs, including CVE-2021-3838 and CVE-2022-2400.
References
Related vulnerabilities
Recent vulnerabilities recorded for php-dompdf.
