models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP     metadata entries. (CVE-2021-29421)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP
    metadata entries. (CVE-2021-29421)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-d97bc581be advisory.

  - models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP     metadata entries. (CVE-2021-29421)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-4bf9909a76 advisory.

  - models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP     metadata entries. (CVE-2021-29421)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
243982	Linux Distros Unpatched Vulnerability : CVE-2021-29421	Nessus	Misc.	high
413824	SCA: security update for pikepdf (GHSA-ccgm-3xw4-h5p8)	Tenable Cloud Security	SCA Checks	high
413824	SCA: security update for pikepdf (GHSA-ccgm-3xw4-h5p8)	Tenable Self-Hosted Container Security	SCA Checks	high
406683	Alpine: multiple py3-pikepdf packages: security update to 2.9.1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406683	Alpine: multiple py3-pikepdf packages: security update to 2.9.1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400242	Alpine: multiple py3-pikepdf packages: security update to 2.9.1-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400242	Alpine: multiple py3-pikepdf packages: security update to 2.9.1-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
148803	Fedora 32 : python-pikepdf (2021-d97bc581be)	Nessus	Fedora Local Security Checks	high
148792	Fedora 33 : python-pikepdf (2021-4bf9909a76)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2021-29421

high

Tenable Plugins

high

high

high

high

high

high

high

high

high