PT-2021-6517 · Exiv2+6 · Exiv2+6

Kevin Backhouse · Published 2021-08-09 · Updated 2025-01-10 · CVE-2021-34334

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 versions prior to v0.27.5

Description The issue is related to an infinite loop triggered when Exiv2 is used to read the metadata of a crafted image file. This could potentially be exploited by an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The vulnerability allows a remote attacker to cause a denial of service using a specially crafted image file.

Recommendations For versions prior to v0.27.5, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of Exiv2 to read metadata from untrusted image files until the update is applied.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2021-3110

ALT-PU-2021-3499

ALT-PU-2024-13399

AZL-7215

BDU:2022-01777

CVE-2021-34334

DLA-3265-1

GHSA-HQJH-HPV8-8R9P

MGASA-2021-0415

OESA-2021-1451

OESA-2022-1955

OESA-2022-2044

OPENSUSE-SU-2022_3889-1

OPENSUSE-SU-2022_3892-1

OPENSUSE-SU-2024:12405-1

SUSE-SU-2022:3889-1

SUSE-SU-2022:3892-1

SUSE-SU-2022:4252-1

USN-5043-1

Affected Products

Alt Linux

Astra Linux

Exiv2

Linuxmint

Red Os

Suse

Ubuntu

References · 108

• https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p · Patch
• https://github.com/Exiv2/exiv2/pull/1766 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34334 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37620 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-34334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37621 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-34334 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37622 · Security Note
• https://osv.dev/vulnerability/AZL-7215 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0415.html · Security Note