PT-2021-14348 · Pypi+1 · Cairosvg+1

Ben Caller · Published 2021-01-06 · Updated 2024-01-26 · CVE-2021-21236

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions: CairoSVG versions prior to 2.5.1

Description: The issue is related to a regular expression denial of service (REDoS) vulnerability in CairoSVG, a Python package used for converting SVG files. When processing SVG files, CairoSVG uses two regular expressions that are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can cause CairoSVG to get stuck processing the file for a very long time. The vulnerability is caused by the complexity of the regular expressions, which can lead to catastrophic backtracking when processing a long string of spaces. The complexity is cubic, meaning that doubling the length of the malicious string of spaces makes processing take 8 times as long.

Recommendations: For versions prior to 2.5.1, update to version 2.5.1 or later to fix the regular expression denial of service (REDoS) vulnerability. As a temporary workaround, consider avoiding the use of the vulnerable regular expressions in the colors.py file until a patch is available. Restrict access to the cairosvg package to minimize the risk of exploitation. Avoid using malicious SVG files that can cause the package to get stuck processing the file for a very long time.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2024-1459

CVE-2021-21236

GHSA-HQ37-853P-G5CF

MGASA-2021-0149

OPENSUSE-SU-2023:0260-1

OPENSUSE-SU-2023:0272-1

OPENSUSE-SU-2024:13218-1

PYSEC-2021-5

Affected Products

Alt Linux

Cairosvg

References · 29

• 🔥 https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf · Exploit
• https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3 · Patch
• https://osv.dev/vulnerability/MGASA-2021-0149 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21236 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0149.html · Security Note
• https://osv.dev/vulnerability/CVE-2021-21236 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21236 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21236 · Security Note
• https://ubuntu.com/security/CVE-2021-21236 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0260-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-5 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21236 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21236 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hq37-853p-g5cf · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0272-1 · Vendor Advisory