View online: https://www.drupal.org/sa-contrib-2022-048

Project: Entity Print [1] Date: 2022-July-13 Security risk: *Moderately critical* 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Multiple: Remote Code Execution, Information disclosure

Description:  This module enables you to generate print versions of content. Some installations of the module make use of the dompdf/dompdf third-party dependency. Security vulnerabilities exist for versions of dompdf/dompdf < 2.0.0

See the library release notes for more detail: https://github.com/dompdf/dompdf/releases/tag/v2.0.0 [3]

.... Note on 3rd party vulnerabilities

This security advisory corresponds to a 3rd party vulnerability. Normally the Drupal Security Team would not issue advisories related to 3rd party code that is shipped separately from a module per our policy (most recent update is PSA-2019-09-04 [4]). In this case, because the module required a specific version and could not be updated without a change to the Drupal module we do issue an advisory.

Solution:  Install the latest version (8.x-2.6 [5]) of this module and update dompdf/dompdf at the same time. It is recommended to use composer to do the update using commands similar to the following:

composer update drupal/entity_print composer require dompdf/dompdf:~2 Reported By:  * szato [6] * Munavir P k [7]

Fixed By:  * Lee Rowlands [8] of the Drupal Security Team * Carlos Santana [9] * Manoj Selvan [10]

Coordinated By:  * Lee Rowlands [11] of the Drupal Security Team * Greg Knaddison [12] of the Drupal Security Team

[1] https://www.drupal.org/project/entity_print [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/dompdf/dompdf/releases/tag/v2.0.0 [4] https://www.drupal.org/psa-2019-09-04 [5] https://www.drupal.org/project/entity_print/releases/8.x-2.6 [6] https://www.drupal.org/user/389677 [7] https://www.drupal.org/user/3604066 [8] https://www.drupal.org/user/395439 [9] https://www.drupal.org/user/1781526 [10] https://www.drupal.org/user/3693487 [11] https://www.drupal.org/user/395439 [12] https://www.drupal.org/user/36762