PT-2020-22675 · Exiv2 · Exiv2

Published 2020-01-27 · Updated 2020-01-27

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.27.2

Description The issue allows remote attackers to cause a denial of service via a crafted file, resulting in an infinite loop and high CPU consumption in the Jp2Image::readMetadata() function.

Recommendations For Exiv2 version 0.27.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

PYSEC-2020-344

Affected Products

Exiv2

References · 6

• https://debian.org/security/2021/dsa-4958 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-344 · Vendor Advisory
• https://github.com/Exiv2/exiv2/issues/1011 · Note
• https://github.com/Exiv2/exiv2/commit/a82098f4f90cd86297131b5663c3dec6a34470e8 · Note
• https://usn.ubuntu.com/4270-1 · Note
• https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html · Note