CVE-2021-21236
Medium
Description
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
SeverityMedium
CVSS5.7
Exploit probability—
ProductCourtbouillon Cairosvg
PublishedJan 6, 2021
First seenJan 6, 2021
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- courtbouillon cairosvg2.5.1 or later
- cairosvg2.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| courtbouillon cairosvg | v < 2.5.1 | 2.5.1 |
| cairosvgPyPI | v < 2.5.1 | 2.5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.