PT-2021-14347 · Unknown · Kamadak-Exif

Kamadak · Published 2021-01-04 · Updated 2022-10-19 · CVE-2021-21235

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: kamadak-exif version 0.5.2

Description: The issue is related to an infinite loop in parsing crafted PNG files, specifically in the reader::read from container function. This can lead to a denial-of-service (DoS) condition when used with untrusted data. Applications that do not pass files with the PNG signature to Reader::read from container are not affected.

Recommendations: For kamadak-exif version 0.5.2, update to version 0.5.3 to resolve the issue. As a temporary workaround, consider avoiding the use of reader::read from container with crafted PNG files until a patch is available. Restrict access to Reader::read from container to minimize the risk of exploitation.

Fix

Infinite Loop

Resource Exhaustion

Weakness Enumeration

CWE-835

CWE-400

Related Identifiers

CVE-2021-21235

GHSA-PX9G-8HGV-JVG2

RUSTSEC-2021-0143

Affected Products

Kamadak-Exif

References · 14

• https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48 · Patch
• https://cve.org/CVERecord?id=CVE-2021-21235 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21235 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0143 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-px9g-8hgv-jvg2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21235 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21235 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21235 · Vendor Advisory
• https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2 · Note
• https://github.com/kamadak/exif-rs · Note
• https://github.com/kamadak/exif-rs/commit/1b05eab57e484cd7d576d4357b9cda7fdc57df8c · Note
• https://t.me/cvenotify/8206 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2021-0143.html · Note
• https://crates.io/crates/kamadak-exif · Note