Bug 2257808 (CVE-2023-45139)

Summary: CVE-2023-45139 fonttools: XML External Entity Injection (XXE) Vulnerability
Product: [Other] Security Response Reporter: TEJ RATHI <trathi>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: fonttools 4.43.0 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the subsetting module of FontTools, which contains an XML External Entity Injection (XXE) vulnerability. This flaw allows malicious actors to exploit the parsing of candidate fonts, particularly those with an OT-SVG format that includes an SVG table. Through this vulnerability, attackers can manipulate the system to resolve arbitrary entities, potentially allowing them to include files from the filesystem where FontTools is operating or even initiate web requests from the host system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2257809, 2257810, 2257811    
Bug Blocks: 2257812    

Description TEJ RATHI 2024-01-11 06:19:53 UTC 
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c
https://github.com/fonttools/fonttools/releases/tag/4.43.0
https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5
Comment 1 TEJ RATHI 2024-01-11 06:30:36 UTC 
Created fonttools tracking bugs for this issue:

Affects: fedora-all [bug 2257809]


Created rst2pdf tracking bugs for this issue:

Affects: fedora-all [bug 2257810]


Created smc-suruma-fonts tracking bugs for this issue:

Affects: fedora-all [bug 2257811]