PT-2021-6461 · Exiv2+6 · Exiv2+6

Published 2021-06-24 · Updated 2025-01-10 · CVE-2021-32815

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 versions prior to v0.27.5

Description The issue is related to an assertion failure when Exiv2 is used to modify the metadata of a crafted image file, potentially allowing an attacker to cause a denial of service. This bug is only triggered when modifying the metadata, a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, an extra command-line argument such as fi is needed.

Recommendations For versions prior to v0.27.5, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the modification of metadata with Exiv2 until the update is applied. Restrict access to crafted image files to minimize the risk of exploitation.

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

ALT-PU-2021-3110

ALT-PU-2021-3499

ALT-PU-2024-13399

AZL-7214

BDU:2022-01682

CVE-2021-32815

DLA-3265-1

GHSA-MV9G-FXH2-M49M

MGASA-2021-0415

OESA-2021-1451

OESA-2022-1955

OESA-2022-2044

OPENSUSE-SU-2022_4208-1

OPENSUSE-SU-2022_4276-1

OPENSUSE-SU-2024:12507-1

SUSE-SU-2022:4208-1

SUSE-SU-2022:4252-1

SUSE-SU-2022:4276-1

USN-5043-1

Affected Products

Alt Linux

Astra Linux

Exiv2

Linuxmint

Red Os

Suse

Ubuntu

References · 104

• https://github.com/Exiv2/exiv2/pull/1739 · Patch
• https://cve.org/CVERecord?id=CVE-2021-32815 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37616 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37620 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37621 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32815 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37622 · Security Note
• https://advisories.mageia.org/MGASA-2021-0415.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32815 · Security Note