CVE-2022-41343: High severity Dompdf Project Dompdf vulnerability
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
Other sources
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/dompdf/dompdfto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
What is CVE-2022-41343?
CVE-2022-41343 is a vulnerability that allows remote file inclusion in Dompdf before version 2.0.1.
How severe is CVE-2022-41343?
CVE-2022-41343 has a severity level of 7.5 (high) according to the Common Vulnerability Scoring System (CVSS) v3.1.
Which software is affected by CVE-2022-41343?
Dompdf before version 2.0.1 is affected by CVE-2022-41343.
How does CVE-2022-41343 work?
CVE-2022-41343 allows remote file inclusion by bypassing URI validation in Dompdf's `registerFont` function.
Is there a fix for CVE-2022-41343?
Yes, upgrading to Dompdf version 2.0.1 or higher is the recommended fix for CVE-2022-41343.