Bug 1916614 (CVE-2021-21236)

Summary:	CVE-2021-21236 cairosvg: regex vulnerable to a REDoS
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fschwarz, orion
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-01-15 12:27:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1916615, 1916616
Bug Blocks:

Description Marian Rehak 2021-01-15 09:36:59 UTC

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3
https://github.com/Kozea/CairoSVG/releases/tag/2.5.1
https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf
https://pypi.org/project/CairoSVG/

Comment 1 Marian Rehak 2021-01-15 09:37:29 UTC

Created python-cairosvg tracking bugs for this issue:

Affects: epel-7 [bug 1916616]
Affects: fedora-all [bug 1916615]

Comment 2 Felix Schwarz 2021-01-15 10:50:20 UTC

This is already fixed for Fedora since 2021-01-07. Updated cairosvg versions were pushed to stable tonight:
- https://bodhi.fedoraproject.org/updates/FEDORA-2021-8537865fb5
- https://bodhi.fedoraproject.org/updates/FEDORA-2021-a2d05a2e65

The Fedora updates above contain a "backported" patch which was approved upstream: https://github.com/Kozea/CairoSVG/issues/308#issuecomment-755780444

Comment 3 Felix Schwarz 2021-01-15 10:50:55 UTC

sorry, I meant to add comment 2 into the box for bug 1916615, reopening.

Comment 4 Product Security DevOps Team 2021-01-15 12:27:45 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.