CVE-2023-45139

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/03/08/2
http://www.openwall.com/lists/oss-security/2024/03/09/1
https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c	Patch
https://github.com/fonttools/fonttools/releases/tag/4.43.0	Release Notes
https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5	Exploit Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/

Configurations

Configuration 1 (hide)

cpe:2.3:a:fonttools:fonttools:*:*:*:*:*:python:*:*

History

No history.

Information

Published : 2024-01-10 16:15

Updated : 2024-05-01 19:15

NVD link : CVE-2023-45139

Mitre link : CVE-2023-45139

CVE.ORG link : CVE-2023-45139

JSON object : View

Products Affected

fonttools

fonttools

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2023-45139", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-01-10T16:15:46.767", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/03/08/2", "source": "security-advisories@github.com"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/09/1", "source": "security-advisories@github.com"}, {"url": "https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fonttools/fonttools/releases/tag/4.43.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/", "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0."}, {"lang": "es", "value": "fontTools es una librer\u00eda para manipular fuentes, escrita en Python. El m\u00f3dulo subsetting tiene una vulnerabilidad de inyecci\u00f3n de entidades externas XML (XXE) que permite a un atacante resolver entidades arbitrarias cuando se analiza una fuente candidata (fuentes OT-SVG), que contiene una tabla SVG. Esto permite a los atacantes incluir archivos arbitrarios del sistema de archivos en el que se ejecuta fontTools o realizar solicitudes web desde el sistema host. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 4.43.0."}], "lastModified": "2024-05-01T19:15:21.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fonttools:fonttools:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "CA51147F-FB56-471F-AA46-967C55F0AE97", "versionEndExcluding": "4.43.0", "versionStartIncluding": "4.28.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}