An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.
When TCPDF performs network requests through libcurl, the CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER options are configured insecurely — effectively disabling verification of server identity and authenticity of its SSL/TLS certificate. An attacker can in this case substitute a fake server with an unauthorized certificate, and the library will accept the connection without warning. This allows interception and modification of network traffic between the application using TCPDF and the target server.
An attacker can conduct a man-in-the-middle attack, intercepting or modifying data transmitted by TCPDF, leading to violations of confidentiality, integrity, and potentially availability of processed information.
TCPDF should be updated to version 6.8.0 or newer, which introduces a fix that properly configures the CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER options. The fix is available in the project repository (commit aab43ab0a824e956276141a28a24c7c0be20f554).
TCPDF (Tcpdf Project) in all versions before 6.8.0, when the application uses libcurl to perform network connections.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HTcpdf Project Tcpdf
APPTcpdf Project< 6.8.0
Related vulnerabilities
An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.
An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error...
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not...
TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an unt...
TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HT...