by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
References
-
https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c x_refsource_CONFIRM
Affected products
CairoSVG
- ==< 2.9.0
Matching in nixpkgs
pkgs.cairosvg
SVG converter based on Cairo
pkgs.python312Packages.cairosvg
SVG converter based on Cairo
pkgs.python313Packages.cairosvg
SVG converter based on Cairo
pkgs.python314Packages.cairosvg
SVG converter based on Cairo
Package maintainers
-
@sarahec Sarah Clark <seclark@nextquestion.net>