CVE-2021-21236: Regular Expression Denial of Service in CairoSVG

CVE-2021-21236 · Severity: low · CVSS 3.1 · Published 2021-01-06

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

Technologies: CairoSVG (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-21236 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-21236 being exploited in the wild.
How severe is CVE-2021-21236?
Low severity, with a CVSS score of 3.1, published 6 January 2021.
Which products and versions are affected?
CairoSVG (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.1, GIT:introduced=0,fixed=cfc9175e590531d90384aa88845052de53d94bf3|ECOSYSTEM:introduced=0,fixed=2.5.1.
Is there a fix for CVE-2021-21236?
Yes. CairoSVG (PyPI): upgrade to 2.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2021-21236?
Check whether you run CairoSVG (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • CairoSVG (PyPI): upgrade to 2.5.1 or later
    pip install "CairoSVG>=2.5.1"

Affected products

  • CairoSVG (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.1, GIT:introduced=0,fixed=cfc9175e590531d90384aa88845052de53d94bf3|ECOSYSTEM:introduced=0,fixed=2.5.1

Identifiers

  • CVE-2021-21236
  • GHSA-hq37-853p-g5cf
  • PYSEC-2021-5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.