[MDL-70735] Reduce information disclosure from TCPDF version - Moodle Tracker

XML

Word

Printable

Details

Type: Bug
Status: Closed
Priority: Minor
Resolution: Fixed
Affects Version/s: 3.11
Fix Version/s: 3.11
Component/s: Libraries
Labels:

Testing Instructions:

Hide

1) Add the attached test script to your web root and run it in a browser

http://moodle.local/MDL-70735-pdf-hello-world.php

2) Save this PDF

3) Inspect the metadata with any pdf metadata tool such as pdfinfo on linux

$ pdfinfo doc.pdf

Producer: TCPDF (http://www.tcpdf.org)

CreationDate: Fri Jan 29 12:27:49 2021 AEDT

ModDate: Fri Jan 29 12:27:49 2021 AEDT

Tagged: no

UserProperties: no

Suspects: no

Form: none

JavaScript: no

Pages: 1

Encrypted: no

Page size: 595.276 x 841.89 pts (A4)

Page rot: 0

File size: 67768 bytes

Optimized: no

PDF version: 1.7

4) Confirm that the Producer says 'TCPDF (http://www.tcpdf.org)'

Show

1) Add the attached test script to your web root and run it in a browser http://moodle.local/MDL-70735-pdf-hello-world.php 2) Save this PDF 3) Inspect the metadata with any pdf metadata tool such as pdfinfo on linux $ pdfinfo doc.pdf Producer: TCPDF (http://www.tcpdf.org) CreationDate: Fri Jan 29 12:27:49 2021 AEDT ModDate: Fri Jan 29 12:27:49 2021 AEDT Tagged: no UserProperties: no Suspects: no Form: none JavaScript: no Pages: 1 Encrypted: no Page size: 595.276 x 841.89 pts (A4) Page rot: 0 File size: 67768 bytes Optimized: no PDF version: 1.7 4) Confirm that the Producer says 'TCPDF ( http://www.tcpdf.org )'

Affected Branches:
MOODLE_311_STABLE
Fixed Branches:
MOODLE_311_STABLE
Pull from Repository:
https://github.com/brendanheywood/moodle
Pull 3.11 Branch:
~~MDL-70735~~-pdf-metadata-MOODLE_311_STABLE
Pull 3.11 Diff URL:
https://github.com/moodle/moodle/compare/MOODLE_311_STABLE...brendanheywood:MDL-70735-pdf-metadata-MOODLE_311_STABLE
Pull Master Branch:
~~MDL-70735~~-pdf-metadata
Pull Master Diff URL:
https://github.com/moodle/moodle/compare/master...brendanheywood:MDL-70735-pdf-metadata

Description

We've had a couple pen tests report information disclosure from the PDF metadata. It is admittedly very low but discloses the version of tcpdf which could be related future known vulnerabilities in that version.

Attachments

Options
- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

Attachments

image-2021-02-17-13-16-09-624.png
30 kB
17/Feb/21 1:16 PM
MDL-70735-pdf-hello-world.php
0.2 kB
29/Jan/21 9:44 AM

Activity

People

Assignee:: Brendan Heywood

Reporter:: Brendan Heywood

Peer reviewer:: Nicholas Hoobin

Integrator:: Adrian Greeve

Tester:: Janelle Barcega

Participants:: Adrian Greeve, Brendan Heywood, CiBoT, Janelle Barcega, Nicholas Hoobin

Component watchers:: Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Ilya Tregubov, Sara Arjona (@sarjona)

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 29/Jan/21 9:24 AM

Updated:: 19/Feb/21 9:38 PM

Resolved:: 19/Feb/21 9:38 PM

Fix Release Date:: 10/May/21

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

1h 10m