PT-2023-32978 · Libwebp+2 · Libwebp+2

Publicado 2023-11-16 · Atualizado 2023-11-16

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sharp versions prior to 0.32.6

Description The issue affects sharp, which uses libwebp to decode WebP images. Almost anyone processing untrusted input with versions of sharp prior to 0.32.6 is affected.

Recommendations For sharp versions prior to 0.32.6, upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2. If using a globally-installed libvips, ensure you are using the latest libwebp 1.3.2. As a temporary workaround, consider adding sharp.block({ operation: ["VipsForeignLoadWebp"] }); to your code to prevent sharp from decoding WebP images.

Correção

Identificadores relacionados

GHSA-54XQ-CGQR-RPM3

Produtos afetados

Libvips

Libwebp

Sharp

Referências · 4

• https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3 · Nota
• https://github.com/lovell/sharp · Nota
• https://github.com/lovell/sharp/commit/dbce6fab795ca4250bda9b1ef502c1fdb7d4a30c · Nota
• https://osv.dev/vulnerability/GHSA-54xq-cgqr-rpm3 · Aviso do Fabricante