cairosvg: CVE-2023-27586: SSRF & DOS vulnerability

Debian Bug report logs - #1033295
cairosvg: CVE-2023-27586: SSRF & DOS vulnerability

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: cairosvg: CVE-2023-27586: SSRF & DOS vulnerability

Date: Tue, 21 Mar 2023 20:40:17 +0100

Source: cairosvg
Version: 2.5.2-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for cairosvg.

CVE-2023-27586[0]:
| CairoSVG is an SVG converter based on Cairo, a 2D graphics library.
| Prior to version 2.7.0, Cairo can send requests to external hosts when
| processing SVG files. A malicious actor could send a specially crafted
| SVG file that allows them to perform a server-side request forgery or
| denial of service. Version 2.7.0 disables CairoSVG's ability to access
| other files online by default.

I am planning to look in the current bullseye version for a security
upload, and can have a look as well for doing a NMU reaching bookworm.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-27586
    https://www.cve.org/CVERecord?id=CVE-2023-27586
[1] https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv
[2] https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255 

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.