{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"High"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"python-fonttools security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for python-fonttools is now available for openEuler-22.03-LTS-SP3.",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"FontTools is a library for manipulating fonts, written in Python. The project includes the TTX tool, that can convert TrueType and OpenType fonts to and from an XML text format, which is also called TTX. It supports TrueType, OpenType, AFM and to an extent Type 1 and some Mac-specific formats. The project has an MIT open-source licence.\n\nSecurity Fix(es):\n\nfontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.(CVE-2023-45139)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for python-fonttools is now available for openEuler-22.03-LTS-SP3.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"High",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"python-fonttools",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2024-1080",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1080"
			},
			{
				"summary":"CVE-2023-45139",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2023-45139&packageName=python-fonttools"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45139"
			},
			{
				"summary":"openEuler-SA-2024-1080 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2024/csaf-openeuler-sa-2024-1080.json"
			}
		],
		"title":"An update for python-fonttools is now available for openEuler-22.03-LTS-SP3",
		"tracking":{
			"initial_release_date":"2024-01-19T09:10:03+08:00",
			"revision_history":[
				{
					"date":"2024-01-19T09:10:03+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				},
				{
					"date":"2024-10-31T09:10:03+08:00",
					"summary":"final",
					"number":"2.0.0"
				}
			],
			"generator":{
				"date":"2024-10-31T09:10:03+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2024-10-31T09:10:03+08:00",
			"id":"openEuler-SA-2024-1080",
			"version":"2.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP3"
									},
									"product_id":"openEuler-22.03-LTS-SP3",
									"name":"openEuler-22.03-LTS-SP3"
								},
								"name":"openEuler-22.03-LTS-SP3",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP3"
									},
									"product_id":"python3-fonttools-4.39.4-2.oe2203sp3.noarch.rpm",
									"name":"python3-fonttools-4.39.4-2.oe2203sp3.noarch.rpm"
								},
								"name":"python3-fonttools-4.39.4-2.oe2203sp3.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP3"
									},
									"product_id":"fonttools-4.39.4-2.oe2203sp3.noarch.rpm",
									"name":"fonttools-4.39.4-2.oe2203sp3.noarch.rpm"
								},
								"name":"fonttools-4.39.4-2.oe2203sp3.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP3"
									},
									"product_id":"fonttools-help-4.39.4-2.oe2203sp3.noarch.rpm",
									"name":"fonttools-help-4.39.4-2.oe2203sp3.noarch.rpm"
								},
								"name":"fonttools-help-4.39.4-2.oe2203sp3.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP3"
									},
									"product_id":"fonttools-4.39.4-2.oe2203sp3.src.rpm",
									"name":"fonttools-4.39.4-2.oe2203sp3.src.rpm"
								},
								"name":"fonttools-4.39.4-2.oe2203sp3.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP3",
				"product_reference":"python3-fonttools-4.39.4-2.oe2203sp3.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP3:python3-fonttools-4.39.4-2.oe2203sp3.noarch",
					"name":"python3-fonttools-4.39.4-2.oe2203sp3.noarch as a component of openEuler-22.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP3",
				"product_reference":"fonttools-4.39.4-2.oe2203sp3.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP3:fonttools-4.39.4-2.oe2203sp3.noarch",
					"name":"fonttools-4.39.4-2.oe2203sp3.noarch as a component of openEuler-22.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP3",
				"product_reference":"fonttools-help-4.39.4-2.oe2203sp3.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP3:fonttools-help-4.39.4-2.oe2203sp3.noarch",
					"name":"fonttools-help-4.39.4-2.oe2203sp3.noarch as a component of openEuler-22.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP3",
				"product_reference":"fonttools-4.39.4-2.oe2203sp3.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP3:fonttools-4.39.4-2.oe2203sp3.src",
					"name":"fonttools-4.39.4-2.oe2203sp3.src as a component of openEuler-22.03-LTS-SP3"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2023-45139",
			"notes":[
				{
					"text":"fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-22.03-LTS-SP3:python3-fonttools-4.39.4-2.oe2203sp3.noarch",
					"openEuler-22.03-LTS-SP3:fonttools-4.39.4-2.oe2203sp3.noarch",
					"openEuler-22.03-LTS-SP3:fonttools-help-4.39.4-2.oe2203sp3.noarch",
					"openEuler-22.03-LTS-SP3:fonttools-4.39.4-2.oe2203sp3.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-22.03-LTS-SP3:python3-fonttools-4.39.4-2.oe2203sp3.noarch",
						"openEuler-22.03-LTS-SP3:fonttools-4.39.4-2.oe2203sp3.noarch",
						"openEuler-22.03-LTS-SP3:fonttools-help-4.39.4-2.oe2203sp3.noarch",
						"openEuler-22.03-LTS-SP3:fonttools-4.39.4-2.oe2203sp3.src"
					],
					"details":"python-fonttools security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1080"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-22.03-LTS-SP3:python3-fonttools-4.39.4-2.oe2203sp3.noarch",
						"openEuler-22.03-LTS-SP3:fonttools-4.39.4-2.oe2203sp3.noarch",
						"openEuler-22.03-LTS-SP3:fonttools-help-4.39.4-2.oe2203sp3.noarch",
						"openEuler-22.03-LTS-SP3:fonttools-4.39.4-2.oe2203sp3.src"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2023-45139"
		}
	]
}