Bug 2257808 (CVE-2023-45139) - CVE-2023-45139 fonttools: XML External Entity Injection (XXE) Vulnerability
Summary: CVE-2023-45139 fonttools: XML External Entity Injection (XXE) Vulnerability
Keywords:
Status: NEW
Alias: CVE-2023-45139
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2257809 2257810 2257811
Blocks: 2257812
TreeView+ depends on / blocked
 
Reported: 2024-01-11 06:19 UTC by TEJ RATHI
Modified: 2024-01-19 11:58 UTC (History)
0 users

Fixed In Version: fonttools 4.43.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the subsetting module of FontTools, which contains an XML External Entity Injection (XXE) vulnerability. This flaw allows malicious actors to exploit the parsing of candidate fonts, particularly those with an OT-SVG format that includes an SVG table. Through this vulnerability, attackers can manipulate the system to resolve arbitrary entities, potentially allowing them to include files from the filesystem where FontTools is operating or even initiate web requests from the host system.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description TEJ RATHI 2024-01-11 06:19:53 UTC 
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c
https://github.com/fonttools/fonttools/releases/tag/4.43.0
https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5
Comment 1 TEJ RATHI 2024-01-11 06:30:36 UTC 
Created fonttools tracking bugs for this issue:

Affects: fedora-all [bug 2257809]


Created rst2pdf tracking bugs for this issue:

Affects: fedora-all [bug 2257810]


Created smc-suruma-fonts tracking bugs for this issue:

Affects: fedora-all [bug 2257811]
Note You need to log in before you can comment on or make changes to this bug.