by Kastro
Paper/Archive/CVE-2023-27586

CVE-2023-27586

Kozea CairoSVG — CairoSVG improperly processes SVG files loaded from external resources

EPSS 0.7%CVSS 9.9
critical.is priorityof 100
41
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 54.0.540 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

Affected

ProductAffectedFixed inSource
CairoSVG< 2.7.0–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gvrefgithub.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255refgithub.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53refgithub.com/Kozea/CairoSVG/releases/tag/2.7.0