PT-2021-7923 · Exiv2+11 · Exiv2+11

Kevinbackhouse · Published 2021-05-17 · Updated 2025-01-10 · CVE-2021-32617

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.3 and earlier

Description The issue is related to an inefficient algorithm with quadratic complexity in Exiv2, which can be triggered when writing metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, a less frequently used operation than reading metadata.

Recommendations For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of Exiv2 for writing metadata into image files until the update is applied.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALSA-2021:4173

ALT-PU-2021-2006

ALT-PU-2024-13399

AZL-7213

BDU:2023-05484

CESA-2021_4173

CVE-2021-32617

GHSA-W8MV-G8QQ-36MJ

MGASA-2021-0240

OESA-2021-1204

OPENSUSE-SU-2022_3598-1

OPENSUSE-SU-2022_3889-1

OPENSUSE-SU-2024:12381-1

RHSA-2021:4173

RHSA-2021_4173

RLSA-2021:4173

SUSE-SU-2022:3543-1

SUSE-SU-2022:3598-1

SUSE-SU-2022:3889-1

USN-4964-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Exiv2

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 131

• https://github.com/Exiv2/exiv2/pull/1657 · Patch
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj · Patch
• https://osv.dev/vulnerability/SUSE-SU-2022:3543-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32617 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4173 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32617 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29473 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3 · Vendor Advisory
• https://security.gentoo.org/glsa/202312-06 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12381-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29623 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32617 · Security Note