Is tecnickcom/tcpdf affected by CVE-2024-56521?

Packagist tecnickcom/tcpdf is affected in <6.8.0.

Is CVE-2024-56521 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.7%.

high

CVE-2024-56521

Q: Is CVE-2024-56521 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.7%.

Packagist · tecnickcom/tcpdf

Summary

TCPDF missing certificate validation

Severity: high
EPSS: 0.7% (p50)
Also known as: GHSA-9mgx-552f-59p6
Published: 2024-12-27

References

https://nvd.nist.gov/vuln/detail/CVE-2024-56521
https://github.com/tecnickcom/TCPDF/commit/aab43ab0a824e956276141a28a24c7c0be20f554
https://github.com/tecnickcom/TCPDF

Related advisories

CVE-2024-56522 — high · Packagist/tecnickcom/tcpdf
CVE-2024-56527 — medium · Packagist/tecnickcom/tcpdf
CVE-2024-56519 — medium · Packagist/tecnickcom/tcpdf
CVE-2024-51058 — medium · Packagist/tecnickcom/tcpdf

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.