CVE-2021-21236

Name	CVE-2021-21236
Description	CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	979597

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cairosvg (PTS)	buster	1.0.20-1	fixed
	bullseye	2.5.0-1.1+deb11u2	fixed
	bullseye (security)	2.5.0-1.1+deb11u1	fixed
	bookworm	2.5.2-1.1+deb12u1	fixed
	sid, trixie	2.7.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
cairosvg	source	stretch	(not affected)
cairosvg	source	buster	(not affected)
cairosvg	source	(unstable)	2.5.0-1.1	979597

Notes

[buster] - cairosvg <not-affected> (Vulnerable code introduced in 2.0.0rc6)
[stretch] - cairosvg <not-affected> (Vulnerable code introduced in 2.0.0rc6)
https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf
Introduced by: https://github.com/Kozea/CairoSVG/commit/4f14d2e8f2d7f9b534c5342e26519b7c27386a81
Fixed by: https://github.com/Kozea/CairoSVG/commit/063185b60588a41d4df661ad70f9f7b699901abc (2.5.1)