cairosvg: CVE-2021-21236: Regular Expression Denial of Service (REDoS)

Debian Bug report logs - #979597
cairosvg: CVE-2021-21236: Regular Expression Denial of Service (REDoS)

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: cairosvg: CVE-2021-21236: Regular Expression Denial of Service (REDoS)

Date: Fri, 08 Jan 2021 21:39:43 +0100

Source: cairosvg
Version: 2.5.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for cairosvg.

CVE-2021-21236[0]:
| CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter
| based on Cairo. In CairoSVG before version 2.5.1, there is a regular
| expression denial of service (REDoS) vulnerability. When processing
| SVG files, the python package CairoSVG uses two regular expressions
| which are vulnerable to Regular Expression Denial of Service (REDoS).
| If an attacker provides a malicious SVG, it can make cairosvg get
| stuck processing the file for a very long time. This is fixed in
| version 2.5.1. See Referenced GitHub advisory for more information.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-21236
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21236
[1] https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf
[2] https://github.com/Kozea/CairoSVG/commit/063185b60588a41d4df661ad70f9f7b699901abc

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.