It was reported that cairosvg, a SVG converter based on Cairo, can send requests to external hosts when processing specially crafted SVG files with external file resource loading. An attacker can take advantage of this flaw to perform a server-side request forgery or denial of service. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-5382-1
When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time (CVE-2021-21236). . MGASA-2021-0149 - Updated python-cairosvg packages fix security vulnerability Publication date: 21 Mar 2021 URL: https://advisories.mageia.org/MGASA-2021-0149.html Type: security Affected Mageia releases: 7 CVE: CVE-2021-21236 When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time (CVE-2021-21236). References: - https://bugs.mageia.org/show_bug.cgi?id=28122 - https://github.com/advisories/GHSA-hq37-853p-g5cf - https://www.cve.org/CVERecord?id=CVE-2021-21236 SRPMS: - 7/core/python-cairosvg-2.2.1-1.1.mga7 . Newly revised python-cairosvg packages mitigate Regular Expression Denial of Service threats on Mageia platforms.. Mageia Security, python cairosvg, Denial of Service Fix. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.