PT-2021-7697 · Exiv2+6 · Exiv2+6

Kevinbackhouse · Published 2021-07-14 · Updated 2025-01-10 · CVE-2021-37622

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description The issue is related to an infinite loop in Exiv2 when modifying the metadata of a crafted image file, potentially allowing an attacker to cause a denial of service. This bug is triggered when deleting the IPTC data, which requires an extra command line option (-d I rm). The vulnerability can be exploited by tricking the victim into running Exiv2 on a specially crafted image file.

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the -d I rm command line option to delete IPTC data until the update is applied.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2021-3110

ALT-PU-2021-3499

ALT-PU-2024-13399

AZL-7224

BDU:2023-01671

CVE-2021-37622

DLA-3265-1

GHSA-9JH3-FCC3-G6HV

MGASA-2021-0415

OESA-2021-1451

OESA-2022-1955

OESA-2022-2044

OPENSUSE-SU-2022_3889-1

OPENSUSE-SU-2024:12405-1

SUSE-SU-2022:3889-1

USN-5043-1

Affected Products

Alt Linux

Astra Linux

Exiv2

Linuxmint

Red Os

Suse

Ubuntu

References · 95

• https://github.com/Exiv2/exiv2/pull/1788 · Patch
• https://ubuntu.com/security/CVE-2021-37616 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-37622 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37620 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37621 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37622 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37622 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0415.html · Security Note
• https://ubuntu.com/security/CVE-2021-37623 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37622 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory