Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1weDlnLThoZ3YtanZnMs4AAvLm

kamadak-exif vulnerable to Infinite loop when parsing PNG files

Impact

Reader::read_from_container can cause an infinite loop when a crafted PNG file is given.

Patches

Version 0.5.3 includes the fix.

Workarounds

No workaround is available.
Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.

References

• https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21235

For more information

If you have any questions or comments about this advisory:

• Open an issue in github.com/kamadak/exif-rs

Permalink: https://github.com/advisories/GHSA-px9g-8hgv-jvg2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1weDlnLThoZ3YtanZnMs4AAvLm
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: almost 2 years ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00357
EPSS Percentile: 0.71801

Identifiers: GHSA-px9g-8hgv-jvg2, CVE-2021-21235
References:

• https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2
• https://nvd.nist.gov/vuln/detail/CVE-2021-21235
• https://github.com/kamadak/exif-rs/commit/1b05eab57e484cd7d576d4357b9cda7fdc57df8c
• https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48
• https://crates.io/crates/kamadak-exif
• https://rustsec.org/advisories/RUSTSEC-2021-0143.html
• https://github.com/advisories/GHSA-px9g-8hgv-jvg2

Repository: https://github.com/kamadak/exif-rs
Blast Radius: 17.1

Affected Packages