A python-CairoSVG security update has been released for SUSE Linux Enterprise 15 SP4.

openSUSE-SU-2023:0272-1: moderate: Security update for python-CairoSVG

openSUSE Security Update: Security update for python-CairoSVG
_______________________________

Announcement ID: openSUSE-SU-2023:0272-1
Rating: moderate
References: #1180648 #1209538
Cross-References: CVE-2021-21236 CVE-2023-27586
CVSS scores:
CVE-2021-21236 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2023-27586 (NVD) : 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Affected Products:
openSUSE Backports SLE-15-SP4
_______________________________

An update that fixes two vulnerabilities is now available.

Description:

This update for python-CairoSVG fixes the following issues:

- CVE-2023-27586: Don't allow fetching external files unless explicitly
asked for. (boo#1209538)

- Update to version 2.5.2

* Fix marker path scale

- Update to version 2.5.1 (boo#1180648, CVE-2021-21236):

* Security fix: When processing SVG files, CairoSVG was using two
regular expressions which are vulnerable to Regular Expression Denial
of Service (REDoS). If an attacker provided a malicious SVG, it could
make CairoSVG get stuck processing the file for a very long time.

* Fix marker positions for unclosed paths
* Follow hint when only output_width or output_height is set
* Handle opacity on raster images
* Donât crash when use tags reference unknown tags
* Take care of the next letter when A/a is replaced by l
* Fix misalignment in node.vertices

- Updates for version 2.5.0.

* Drop support of Python 3.5, add support of Python 3.9.
* Add EPS export
* Add background-color, negate-colors, and invert-images options
* Improve support for font weights
* Fix opacity of patterns and gradients
* Support auto-start-reverse value for orient
* Draw images contained in defs
* Add Exif transposition support
* Handle dominant-baseline
* Support transform-origin

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP4:

zypper in -t patch openSUSE-2023-272=1

Package List:

- openSUSE Backports SLE-15-SP4 (noarch):

python3-CairoSVG-2.5.2-bp154.2.3.1

References:

https://www.suse.com/security/cve/CVE-2021-21236.html
https://www.suse.com/security/cve/CVE-2023-27586.html
https://bugzilla.suse.com/1180648
https://bugzilla.suse.com/1209538