Resource exhaustion in Courtbouillon Cairosvg
CVE-2021-21236
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.015 (71.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H.
Affected products
- Courtbouillon Cairosvg
- Kozea Cairosvg — versions < 2.5.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- security-advisories@github.com (Product, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2021-21236?
- CVE-2021-21236 is a medium-severity vulnerability in Courtbouillon Cairosvg, classified under Uncontrolled Resource Consumption. CVSS score: 5.7/10. Published 2021-01-06.
- How severe is CVE-2021-21236?
- Medium severity. CVSS v3 base score is 5.7 out of 10.
- Is CVE-2021-21236 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.