[MDL-70735] Reduce information disclosure from TCPDF version - Moodle Tracker

XML

Word

Printable

Details

Type: Bug
Status: Closed
Priority: Minor
Resolution: Fixed
Affects Version/s: 3.11
Fix Version/s: 3.11
Component/s: Libraries
Labels:

Affected Branches:
MOODLE_311_STABLE
Fixed Branches:
MOODLE_311_STABLE
Pull from Repository:
https://github.com/brendanheywood/moodle
Pull 3.11 Branch:
~~MDL-70735~~-pdf-metadata-MOODLE_311_STABLE
Pull 3.11 Diff URL:
https://github.com/moodle/moodle/compare/MOODLE_311_STABLE...brendanheywood:MDL-70735-pdf-metadata-MOODLE_311_STABLE
Pull Master Branch:
~~MDL-70735~~-pdf-metadata
Pull Master Diff URL:
https://github.com/moodle/moodle/compare/master...brendanheywood:MDL-70735-pdf-metadata

Testing Instructions:

Hide

1) Add the attached test script to your web root and run it in a browser

http://moodle.local/MDL-70735-pdf-hello-world.php

2) Save this PDF

3) Inspect the metadata with any pdf metadata tool such as pdfinfo on linux

$ pdfinfo doc.pdf

Producer: TCPDF (http://www.tcpdf.org)

CreationDate: Fri Jan 29 12:27:49 2021 AEDT

ModDate: Fri Jan 29 12:27:49 2021 AEDT

Tagged: no

UserProperties: no

Suspects: no

Form: none

JavaScript: no

Pages: 1

Encrypted: no

Page size: 595.276 x 841.89 pts (A4)

Page rot: 0

File size: 67768 bytes

Optimized: no

PDF version: 1.7

4) Confirm that the Producer says 'TCPDF (http://www.tcpdf.org)'

Show

1) Add the attached test script to your web root and run it in a browser http://moodle.local/MDL-70735-pdf-hello-world.php 2) Save this PDF 3) Inspect the metadata with any pdf metadata tool such as pdfinfo on linux $ pdfinfo doc.pdf Producer: TCPDF (http://www.tcpdf.org) CreationDate: Fri Jan 29 12:27:49 2021 AEDT ModDate: Fri Jan 29 12:27:49 2021 AEDT Tagged: no UserProperties: no Suspects: no Form: none JavaScript: no Pages: 1 Encrypted: no Page size: 595.276 x 841.89 pts (A4) Page rot: 0 File size: 67768 bytes Optimized: no PDF version: 1.7 4) Confirm that the Producer says 'TCPDF ( http://www.tcpdf.org )'

Description

We've had a couple pen tests report information disclosure from the PDF metadata. It is admittedly very low but discloses the version of tcpdf which could be related future known vulnerabilities in that version.

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

image-2021-02-17-13-16-09-624.png
30 kB
17/Feb/21 1:16 PM
MDL-70735-pdf-hello-world.php
0.2 kB
29/Jan/21 9:44 AM

Issue Links

has been marked as being related by

MDL-70902 Upgrade TCPDF to 6.4.1 for PHP8 compatibility

Closed

Activity

People

Assignee:: Brendan Heywood

Reporter:: Brendan Heywood

Peer reviewer:: Nicholas Hoobin

Integrator:: Adrian Greeve

Tester:: Janelle Barcega

Participants:: Adrian Greeve, Brendan Heywood, CiBoT, Janelle Barcega, Nicholas Hoobin

Component watchers:: David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 29/Jan/21 9:24 AM

Updated:: 11/May/21 3:27 PM

Resolved:: 19/Feb/21 9:38 PM

Fix Release Date:: 17/May/21

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

1h 10m