CVE-2024-25885: xhtml2pdf Denial of Service via crafted string

October 8, 2024 (updated October 9, 2024)

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.

References

gist.github.com/salvatore-abello/c88dd0027496774023ef36c7b576d206
github.com/advisories/GHSA-jj5c-hhrg-vv5h
github.com/xhtml2pdf/xhtml2pdf
nvd.nist.gov/vuln/detail/CVE-2024-25885

Code Behaviors & Features

Detect and mitigate CVE-2024-25885 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →