CVE-2021-21236
Vulnerability from cvelistv5
Published
2021-01-06 17:00
Modified
2024-08-03 18:09
Severity ?
EPSS score ?
0.12%
(0.47652)
Summary
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T18:09:15.166Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://pypi.org/project/CairoSVG/", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/Kozea/CairoSVG/releases/tag/2.5.1", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "CairoSVG", vendor: "Kozea", versions: [ { status: "affected", version: "< 2.5.1", }, ], }, ], descriptions: [ { lang: "en", value: "CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 5.7, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-400", description: "CWE-400 Uncontrolled Resource Consumption", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-01-06T17:00:19", orgId: "a0819718-46f1-4df5-94e2-005712e83aaa", shortName: "GitHub_M", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf", }, { tags: [ "x_refsource_MISC", ], url: "https://pypi.org/project/CairoSVG/", }, { tags: [ "x_refsource_MISC", ], url: "https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3", }, { tags: [ "x_refsource_MISC", ], url: "https://github.com/Kozea/CairoSVG/releases/tag/2.5.1", }, ], source: { advisory: "GHSA-hq37-853p-g5cf", discovery: "UNKNOWN", }, title: "Regular Expression Denial of Service in CairoSVG", x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security-advisories@github.com", ID: "CVE-2021-21236", STATE: "PUBLIC", TITLE: "Regular Expression Denial of Service in CairoSVG", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "CairoSVG", version: { version_data: [ { version_value: "< 2.5.1", }, ], }, }, ], }, vendor_name: "Kozea", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.", }, ], }, impact: { cvss: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 5.7, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-400 Uncontrolled Resource Consumption", }, ], }, ], }, references: { reference_data: [ { name: "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf", refsource: "CONFIRM", url: "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf", }, { name: "https://pypi.org/project/CairoSVG/", refsource: "MISC", url: "https://pypi.org/project/CairoSVG/", }, { name: "https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3", refsource: "MISC", url: "https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3", }, { name: "https://github.com/Kozea/CairoSVG/releases/tag/2.5.1", refsource: "MISC", url: "https://github.com/Kozea/CairoSVG/releases/tag/2.5.1", }, ], }, source: { advisory: "GHSA-hq37-853p-g5cf", discovery: "UNKNOWN", }, }, }, }, cveMetadata: { assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa", assignerShortName: "GitHub_M", cveId: "CVE-2021-21236", datePublished: "2021-01-06T17:00:19", dateReserved: "2020-12-22T00:00:00", dateUpdated: "2024-08-03T18:09:15.166Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2021-21236\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-01-06T17:15:23.733\",\"lastModified\":\"2024-11-21T05:47:50.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.\"},{\"lang\":\"es\",\"value\":\"CairoSVG es un paquete de Python (pypi). CairoSVG es un conversor de SVG basado en Cairo. En CairoSVG versiones anteriores a 2.5.1, se presenta de denegación de servicio de expresión regular (REDoS). Cuando se procesan archivos SVG, el paquete de python CairoSVG utiliza dos expresiones regulares que son vulnerables a una Denegación de Servicio de Expresiones Regulares (REDoS). Si un atacante proporciona un SVG malicioso, puede hacer que cairosvg se atasque al procesar el archivo durante mucho tiempo. Esto es corregido en la versión 2.5.1. Consulte el aviso Referenced GitHub para obtener más información\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:courtbouillon:cairosvg:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.5.1\",\"matchCriteriaId\":\"6D10055D-3299-4F39-B4E2-A52D95ABB225\"}]}]}],\"references\":[{\"url\":\"https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Kozea/CairoSVG/releases/tag/2.5.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://pypi.org/project/CairoSVG/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Kozea/CairoSVG/releases/tag/2.5.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://pypi.org/project/CairoSVG/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\",\"Third Party Advisory\"]}]}}", }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.