CVE-2024-28184

Name	CVE-2024-28184
Description	WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
weasyprint (PTS)	bullseye	51-2	fixed
	bookworm	57.2-1	fixed
	forky, sid, trixie	62.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
weasyprint	source	bullseye	(not affected)
weasyprint	source	bookworm	(not affected)
weasyprint	source	(unstable)	61.2-1

Notes

[bookworm] - weasyprint <not-affected> (Vulnerable code not present)
[bullseye] - weasyprint <not-affected> (Vulnerable code not present)
https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r
https://github.com/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598 (v61.2)