All errata/sisyphus/ALT-PU-2024-1459-2
ALT-PU-2024-1459-2

Package update python3-module-cairosvg in branch sisyphus

Version2.7.1-alt1
Task#339078
Published2026-02-04
Max severityCRITICAL
Severity:

Closed issues (5)

BDU:2023-02149
CRITICAL9.9

Уязвимость SVG-конвертера CairoSVG, связанная с недостаточной проверкой поступающих запросов, позволяющая нарушителю осуществить SSRF-атаку или вызвать отказ в обслуживании

Published: 2023-04-20
CVSS 3.xCRITICAL 9.9
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CVSS 2.0CRITICAL 9.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:C/A:P
References
CVE-2021-21236
MEDIUM5.5

CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.

Published: 2021-01-06Modified: 2024-11-21
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
CVE-2023-27586
HIGH7.1

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

Published: 2023-03-20Modified: 2024-11-21
CVSS 3.xHIGH 7.1
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
References
GHSA-hq37-853p-g5cf
HIGH7.7

Regular Expression Denial of Service in CairoSVG

Published: 2021-01-06Modified: 2024-09-13
CVSS 3.xHIGH 7.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 4.0HIGH 7.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
References
GHSA-rwmf-w63j-p7gv
HIGH7.8

CairoSVG improperly processes SVG files loaded from external resources

Published: 2023-03-21Modified: 2024-11-18
CVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CVSS 4.0HIGH 7.8
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:L
References