CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information. https://github.com/Kozea/CairoSVG/commit/cfc9175e590531d90384aa88845052de53d94bf3 https://github.com/Kozea/CairoSVG/releases/tag/2.5.1 https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf https://pypi.org/project/CairoSVG/
Created python-cairosvg tracking bugs for this issue: Affects: epel-7 [bug 1916616] Affects: fedora-all [bug 1916615]
This is already fixed for Fedora since 2021-01-07. Updated cairosvg versions were pushed to stable tonight: - https://bodhi.fedoraproject.org/updates/FEDORA-2021-8537865fb5 - https://bodhi.fedoraproject.org/updates/FEDORA-2021-a2d05a2e65 The Fedora updates above contain a "backported" patch which was approved upstream: https://github.com/Kozea/CairoSVG/issues/308#issuecomment-755780444
sorry, I meant to add comment 2 into the box for bug 1916615, reopening.
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.