5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
47.9%
CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on
Cairo. In CairoSVG before version 2.5.1, there is a regular expression
denial of service (REDoS) vulnerability. When processing SVG files, the
python package CairoSVG uses two regular expressions which are vulnerable
to Regular Expression Denial of Service (REDoS). If an attacker provides a
malicious SVG, it can make cairosvg get stuck processing the file for a
very long time. This is fixed in version 2.5.1. See Referenced GitHub
advisory for more information.
github.com/Kozea/CairoSVG/commit/063185b60588a41d4df661ad70f9f7b699901abc (2.5.1)
github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3
github.com/Kozea/CairoSVG/releases/tag/2.5.1
github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf
launchpad.net/bugs/cve/CVE-2021-21236
nvd.nist.gov/vuln/detail/CVE-2021-21236
pypi.org/project/CairoSVG/
security-tracker.debian.org/tracker/CVE-2021-21236
www.cve.org/CVERecord?id=CVE-2021-21236
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
47.9%