PT-2021-11553 · Color · Color
Liyuan Chen
+1
·
Published
2021-02-18
·
Updated
2021-03-01
·
CVE-2020-28496
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
three versions prior to 0.125.0
Description:
This issue affects the handling of rgb or hsl colors. A proof of concept (PoC) demonstrates the impact by creating a large string of spaces within an rgb color definition, which can be used to measure the time cost of processing such input. The PoC code defines a function
build blank(n) that generates a string of n spaces within an rgb color string, then measures the time it takes to create a new Color object with this string.Recommendations:
For versions prior to 0.125.0, consider updating to version 0.125.0 or later to resolve the issue. As a temporary workaround, consider restricting the handling of rgb or hsl colors to prevent potential exploitation. Avoid using the
Color function with untrusted input until the issue is resolved. At the moment, there is no information about additional mitigation measures.Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Color