PT-2023-6960 · Golang+2 · Golang+2

Philippe Antoine · Publicado 2023-08-02 · Atualizado 2023-11-16 · CVE-2023-29407

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Golang (affected versions not specified)

Description The issue is related to excessive CPU consumption during decoding. A maliciously-crafted image, specifically a tiled image with a height of 0 and a very large width, can cause this excessive consumption. This can happen despite the image size appearing to be zero, as the width and height calculation (width * height) would result in zero. This could allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-834

Identificadores relacionados

BDU:2023-07979

CVE-2023-29407

GHSA-J3P8-6MRQ-6G7H

GO-2023-1990

Produtos afetados

Debian

Golang

Red Os

Referências · 24

• https://security-tracker.debian.org/tracker/CVE-2023-29407 · Aviso do Fabricante
• https://go.dev/issue/61581 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure · Nota
• https://osv.dev/vulnerability/CVE-2023-29407 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-29407 · Nota de Segurança
• https://packages.debian.org/src:golang-golang-x-image · Nota
• https://security-tracker.debian.org/tracker/source-package/golang-golang-x-image · Aviso do Fabricante
• https://go.dev/cl/514897 · Correção
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29407 · Nota de Segurança
• https://pkg.go.dev/vuln/GO-2023-1990 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-07979 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20230831-0009 · Nota