Regular Expression Denial of Service Vulnerability in xhtml2pdf Package
Summary
DEBIAN-CVE-2024-25885: An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string. Affects xhtml2pdf versions < 0.2.16+dfsg-1. Fixed in 0.2.16+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xhtml2pdf is a Python library that converts HTML and CSS documents into PDF files. It is widely used for generating reports and documents from web applications. The package is designed to handle various HTML and CSS features, making it a versatile tool for developers. However, it has been found to contain a vulnerability in its getcolor function, which can be exploited under certain conditions.
Vulnerability Detail
The vulnerability arises from the getcolor function in utils.py of xhtml2pdf version 0.2.13. Attackers can exploit this flaw by supplying a crafted string that triggers a Regular Expression Denial of Service (ReDOS). This type of attack can lead to significant performance degradation, causing the application to become unresponsive and potentially affecting the availability of services relying on this library.
How To Fix
Minimum fixed version
0.2.16+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xhtml2pdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted input for the getcolor function. Implement input validation to ensure that only safe and expected strings are processed by the function.
Conclusion
The xhtml2pdf package has a vulnerability that can lead to a Regular Expression Denial of Service. It is crucial to update to the patched version 0.2.16+dfsg-1 to mitigate this risk. Implementing input validation can serve as a temporary workaround while ensuring the security of your application.
See every vulnerability recorded for xhtml2pdf →
FAQ
The vulnerability is a Regular Expression Denial of Service (ReDOS) that can be triggered by supplying a crafted string to the getcolor function.
Versions prior to 0.2.16+dfsg-1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to application unresponsiveness, affecting the availability of services that depend on xhtml2pdf.
Yes, you can implement input validation to ensure that only safe strings are processed by the getcolor function as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for xhtml2pdf.
