CVE-2021-21236
In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability.
Does this matter?
Lower severity and a low EPSS score (1.47%). Track it; it rarely justifies an emergency change on its own.
Description
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 1.47% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- courtbouillon/cairosvg
- Source
- security-advisories@github.com
References
- https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3Patch, Third Party Advisory
- https://github.com/Kozea/CairoSVG/releases/tag/2.5.1Release Notes, Third Party Advisory
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cfExploit, Third Party Advisory
- https://pypi.org/project/CairoSVG/Product, Third Party Advisory
- https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3Patch, Third Party Advisory
- https://github.com/Kozea/CairoSVG/releases/tag/2.5.1Release Notes, Third Party Advisory
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cfExploit, Third Party Advisory
- https://pypi.org/project/CairoSVG/Product, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.