CVE-2024-25885
CVE-2024-25885
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
CVSS 7.5 · High · EPSS 0.6% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
xhtml2pdf Debian:12
- Versions
- 0.2.15+dfsg-1
- 0.2.15+dfsg-2
- 0.2.16+dfsg-1
- 0.2.17+dfsg-1
- 0.2.5-3
- 0.2.5-4
- 0.2.5-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xhtml2pdf Debian:13
- Affected ranges
- ECOSYSTEM: < 0.2.16+dfsg-1
Update to 0.2.16+dfsg-1
xhtml2pdf Debian:14
- Affected ranges
- ECOSYSTEM: < 0.2.16+dfsg-1
Update to 0.2.16+dfsg-1
xhtml2pdf PyPI
- Versions
- 0.0.0
- 0.0.1
- 0.0.2
- 0.0.3
- 0.0.4
- 0.0.5
- 0.0.6
- 0.1a1
- 0.1a2
- 0.1a3
- 0.1a4
- 0.1b1
- 0.1b2
- 0.1b3
- 0.2
- 0.2.1
- 0.2.10
- 0.2.11
- 0.2.12
- 0.2.13
- 0.2.14
- 0.2.15
- 0.2.16
- 0.2.2
- 0.2.3
- 0.2.4
- 0.2.5
- 0.2.6
- 0.2.7
- 0.2.8
- 0.2.9
- 0.2b1
- Affected ranges
- ECOSYSTEM: ≤ 0.2.16
No fix published
xhtml2pdf Ubuntu:18.04:LTS
- Versions
- 0.2b-1
- 0.2b-2
- 0.2.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xhtml2pdf Ubuntu:20.04:LTS
- Versions
- 0.2.2-3
- 0.2.2-3build1
- 0.2.2-5
- 0.2.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xhtml2pdf Ubuntu:22.04:LTS
- Versions
- 0.2.4-1
- 0.2.4-1ubuntu1
- 0.2.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xhtml2pdf Ubuntu:24.04:LTS
- Versions
- 0.2.5-3
- 0.2.5-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xhtml2pdf Ubuntu:25.10
- Versions
- 0.2.17+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xhtml2pdf Ubuntu:26.10
- Versions
- 0.2.17+dfsg-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xhtml2pdf Ubuntu:26.04:LTS
- Versions
- 0.2.17+dfsg-1ubuntu1
- 0.2.17+dfsg-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published