USN-6232-1: wkhtmltopdf vulnerability
20 July 2023
wkhtmltopdf could be made to expose sensitive information if it opened a specially crafted file.
- wkhtmltopdf - Command line utility to convert html to pdf using WebKit
It was discovered that wkhtmltopdf was not properly enforcing the
same-origin policy when processing certain HTML files. If a user or
automated system using wkhtmltopdf were tricked into processing a
specially crafted HTML file, an attacker could possibly use this issue to
expose sensitive information.
The problem can be corrected by updating your system to the following package versions:
- wkhtmltopdf - 0.12.4-1ubuntu0.1~esm1
- wkhtmltopdf - 0.12.2.4-1ubuntu0.1~esm1
- wkhtmltopdf - 0.9.9-4ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.