Request for security patch: TCPDF Vulnerabilities in Matomo 5.2.2

[drahosistvan]

There are several critical vulnerabilities in the current production version of Matomo (5.2.2) due to its dependency on TCPDF version 6.7. The following CVEs have been identified as high or critical:

• CVE-2024-56520
• CVE-2024-56521
• CVE-2024-56519
• CVE-2024-56522
• CVE-2024-56527
  These vulnerabilities pose significant security risks, potentially affecting data integrity and server security. Given the severity, I recommend considering an expedited release of version 5.2.3 with an upgraded TCPDF to version 6.8, as already proposed in PR [automatic composer updates] #22906.

Considering that the milestone for version 5.3 is approximately 75-80% complete, is there an opportunity to release Matomo 5.2.3 with the necessary TCPDF update to mitigate these vulnerabilities promptly?

Thank you for addressing this critical issue.

[sgiehl]

Hey @drahosistvan.
Thanks for raising this issue.
We aim to release a first RC of 5.3.0 this week. So the final release isn't too far ahead.