CVE-2019-20446

2020-02-0200:00:00

ubuntu.com

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.005 Low

EPSS

Percentile

77.2%

JSON

In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested
patterns can cause denial of service when passed to the library for
processing. The attacker constructs pattern elements so that the number of
final rendered objects grows exponentially.

Bugs

<https://gitlab.gnome.org/GNOME/librsvg/issues/515>
<https://bugs.launchpad.net/ubuntu/+source/librsvg/+bug/1889206 (regression)>
<https://gitlab.gnome.org/GNOME/librsvg/-/issues/612 (regression)>

Notes

Author	Note
mdeslaur	also affects older versions written in C The fixes added to 2.40.21 cause a regression, and upstream will not be fixing them.
rodrigo-zaiden	backporting the missing part of the fix from the 2.46 version (in Rust) to 2.40 (in C) is not trivial and requires an effort for someone involved in the project. as of 2022-11-25, there is no new commits in 2.40 branch.
ccdm94	upstream has released a fix for this issue, and also a new version containing said fix (2.40.21). Applying the patch recovered from version 2.40.21 caused a regression, as per launchpad bug 1889206, and there have been no additional commits in branch 2.40 in the last 2 years (last commit in 2020-02-26). In issue 612, upstream mentions that they will no longer provide fixes to branch 2.40. They also mention the fix to the regression, available for later versions of the code, but backporting it is not viable, as the code has been refactored and is now in an entirely different programming language. This mean there are no possible commits provided that would allow a fix for the regression in releases containing the C version of the code. Therefore, this issue will be marked as ignored for bionic and earlier.