PT-2021-3401 · Is-Svg · Is-Svg

Published 2021-06-21 · Updated 2021-12-10 · CVE-2021-29059

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IS-SVG versions 2.1.0 through 4.3.1

Description The issue is related to a Regular Expression Denial of Service (ReDOS) that occurs when the application checks a crafted invalid SVG string. This can lead to unlimited memory allocation, potentially allowing a remote attacker to cause a denial of service.

Recommendations For IS-SVG versions 2.1.0 through 4.3.1, consider disabling the use of crafted SVG strings until a patch is available. As a temporary workaround, restrict the application from checking invalid SVG strings to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2021-03252

CVE-2021-29059

GHSA-R8J5-H5CX-65GG

Affected Products

Is-Svg

References · 12

• 🔥 https://github.com/yetingli/PoCs/blob/main/CVE-2021-29059/IS-SVG.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-29059 · Security Note
• https://osv.dev/vulnerability/GHSA-r8j5-h5cx-65gg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29059 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03252 · Security Note
• https://github.com/sindresorhus/is-svg/releases/tag/v4.3.0 · Note
• https://github.com/sindresorhus/is-svg/commit/732fc72779840c45a30817d3fe28e12058592b02 · Note
• https://github.com/sindresorhus/is-svg · Note
• https://github.com/yetingli/SaveResults/blob/main/js/is-svg.js · Note
• https://npmjs.com/package/is-svg · Note
• https://vuldb.com/?id.177314 · Note
• https://t.me/cvenotify/22965 · Telegram Post