CVE-2021-29421: 
Python vulnerability analysis and mitigation

The vulnerability CVE-2021-29421 affects the pikepdf package versions 1.3.0 through 2.9.2 for Python. The vulnerability was discovered in the models/metadata.py component and allows XML External Entity (XXE) attacks when parsing XMP metadata entries. The issue was reported by Eric Therond of Sonarsource and was fixed in pikepdf version 2.10.0, released in April 2021 (GitHub Commit, Fedora Update).

The vulnerability exists in the XMP metadata parsing functionality of pikepdf. The issue occurs because the XML parser did not have proper protections against XXE attacks. The fix involved implementing a custom XMLParser class that explicitly disables entity resolution and network access by setting 'resolve_entities=False' and 'no_network=True' parameters (GitHub Commit).

An attacker who can supply a specially crafted PDF file could potentially exploit this vulnerability to read arbitrary files on the system through XML external entity processing when the PDF's XMP metadata is parsed (Red Hat CVE).

The vulnerability can be exploited by providing a maliciously crafted PDF file containing specially formatted XMP metadata. The attacker would need to be able to have their PDF file processed by an application using an affected version of pikepdf (GitHub Commit).

Users should upgrade to pikepdf version 2.10.0 or later which includes the fix for this vulnerability. The fix prevents XXE attacks by implementing proper XML parser configuration that disables entity resolution and network access (Fedora Update).