DRUPAL-CONTRIB-2022-048 - This module enables you to generate print versions of content. Some installations of the…

Severity: info · Published 2022-07-13

This module enables you to generate print versions of content. Some installations of the module make use of the dompdf/dompdf third-party dependency. Security vulnerabilities exist for versions of dompdf/dompdf < 2.0.0

See the library release notes for more detail: <https://github.com/dompdf/dompdf/releases/tag/v2.0.0>

### Note on 3rd party vulnerabilities

This security advisory corresponds to a 3rd party vulnerability. Normally the Drupal Security Team would not issue advisories related to 3rd party code that is shipped separately from a module per our policy (most recent update is [PSA-2019-09-04](https://www.drupal.org/psa-2019-09-04)). In this case, because the module required a specific version and could not be updated without a change to the Drupal module we do issue an advisory.

Vendors: Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, published 13 July 2022.
Which products and versions are affected?
Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print ECOSYSTEM:introduced=0,fixed=2.6.0.
Is there a fix for This vulnerability?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print: upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected?
Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print: upgrade to 2.6.0 or later

Affected products

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Entity Print ECOSYSTEM:introduced=0,fixed=2.6.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.