PT-2020-5886 · Openexr+4 · Openexr+4

Michael Kaplan · Published 2020-11-11 · Updated 2023-10-17 · CVE-2021-3478

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: OpenEXR versions prior to 3.0.0-beta

Description: The issue is related to the implementation of the scanline input file functionality in the OpenEXR library, specifically in the ImfScanLineInputFile.cpp file. It involves an uncontrolled resource consumption when handling the to data->linesInBuffer parameter. This can be exploited by an attacker to cause a denial of service by opening specially crafted EXR files, potentially consuming excessive system memory and impacting system availability.

Recommendations: For versions prior to 3.0.0-beta, update to version 3.0.0-beta or later to resolve the issue. As a temporary workaround, consider restricting the use of the scanline input file functionality until a patch is available. Avoid processing untrusted or specially crafted EXR files with the vulnerable versions of OpenEXR to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALT-PU-2021-1863

ALT-PU-2021-1864

ALT-PU-2021-1933

ALT-PU-2021-1934

BDU:2021-01976

CVE-2021-3478

DLA-2701-1

DLA-3236-1

MGASA-2021-0326

ROSA-SA-2023-2248

USN-4900-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Openexr

Ubuntu

References · 41

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3236-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4900-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0326.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3478 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2701-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3477 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4996-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1939160 · Patch
• https://ubuntu.com/security/CVE-2021-3475 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3478 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3478 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0326 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3474 · Vendor Advisory