CVE Vulnerability

CVE-2021-21236

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

Scope

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3 Patch Third Party Advisory
https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf Exploit Third Party Advisory
https://pypi.org/project/CairoSVG/ Product Third Party Advisory
https://github.com/Kozea/CairoSVG/releases/tag/2.5.1 Release Notes Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:courtbouillon:cairosvg:*:*:*:*:*:*:*:*
Information

Published : 2021-01-06 05:15

Updated : 2021-01-13 03:43

NVD link : CVE-2021-21236

Mitre link : CVE-2021-21236

Products Affected
No products.
CWE
CWE-400