An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xhtml2pdf | Ubuntu | focal | * |
| Xhtml2pdf | Ubuntu | oracular | * |
| Xhtml2pdf | Ubuntu | plucky | * |
| Xhtml2pdf | Ubuntu | questing | * |