CVE-2021-21236

Katalog CVE

CVSS 5.5 · Medium EPSS 1,4%

Kerentanan Uncontrolled Resource Consumption pada courtbouillon cairosvg. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

Rincian

Terbit di NVD

6 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3 patch · advisory pihak ketiga
• https://github.com/Kozea/CairoSVG/releases/tag/2.5.1 release notes · advisory pihak ketiga
• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf exploit · advisory pihak ketiga
• https://pypi.org/project/CairoSVG/ product · advisory pihak ketiga