~ / search / GHSA-jj5c-hhrg-vv5h

GHSA-jj5c-hhrg-vv5h

xhtml2pdf Denial of Service via crafted string

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-25885

Packages

EcosystemPackageAffectedFixed in
PyPI xhtml2pdf <= 0.2.16 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.

References

External links from the advisory. They lead to third-party sites.