MGASA-2021-0149 - Updated python-cairosvg packages fix security vulnerability Publication date: 21 Mar 2021 URL: https://advisories.mageia.org/MGASA-2021-0149.html Type: security Affected Mageia releases: 7 CVE: CVE-2021-21236 When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time (CVE-2021-21236). References: - https://bugs.mageia.org/show_bug.cgi?id=28122 - https://github.com/advisories/GHSA-hq37-853p-g5cf - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21236 SRPMS: - 7/core/python-cairosvg-2.2.1-1.1.mga7
Mageia 2021-0149: python-cairosvg security update
When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS)
Summary
When processing SVG files, the python package CairoSVG uses two regular
expressions which are vulnerable to Regular Expression Denial of Service
(REDoS). If an attacker provides a malicious SVG, it can make cairosvg
get stuck processing the file for a very long time (CVE-2021-21236).
References
- https://bugs.mageia.org/show_bug.cgi?id=28122
- https://github.com/advisories/GHSA-hq37-853p-g5cf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21236
Resolution
MGASA-2021-0149 - Updated python-cairosvg packages fix security vulnerability
SRPMS
- 7/core/python-cairosvg-2.2.1-1.1.mga7
Severity
Publication date: 21 Mar 2021
URL: https://advisories.mageia.org/MGASA-2021-0149.html
Type: security
CVE: CVE-2021-21236
News
HOWTOs
Features
Best Linux Backup Solutions to Prevent Data Loss in A Ransomware Attack
ManageEngine Vulnerability Manager Plus: How To Protect Your Enterprise from Security Vulnerabilities
High-Impact DoS, Arbitrary Code Execution, Spoofing Bugs Fixed in Thunderbird 102.9.0
A Guide to Business Cybersecurity: Common Digital Attacks and Precautions
New Linux IceFire Ransomware Variant Discovered: What You Need to Know to Secure Your Systems
About Us
Powered By
