PT-2021-7928 · Exiv2+5 · Exiv2+5

Kevin Backhouse · Published 2021-08-09 · Updated 2025-01-10 · CVE-2021-37623

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description The issue is related to an infinite loop in the Exiv2 library, which can be triggered when modifying the metadata of a crafted image file. This can potentially allow an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is specifically triggered when deleting the IPTC data, which requires an extra command line option (-d I rm).

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the -d I rm command line option to minimize the risk of exploitation. Restrict access to the Exiv2 operation that requires this option to reduce the likelihood of an attacker triggering the infinite loop.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2021-3110

ALT-PU-2021-3499

ALT-PU-2024-13399

AZL-7225

BDU:2023-05489

CVE-2021-37623

GHSA-MVC4-G5PV-4QQQ

MGASA-2021-0415

OESA-2021-1451

OESA-2022-1955

OESA-2022-2044

OPENSUSE-SU-2022_3889-1

OPENSUSE-SU-2024:12405-1

SUSE-SU-2022:3889-1

USN-5043-1

Affected Products

Alt Linux

Exiv2

Linuxmint

Red Os

Suse

Ubuntu

References · 90

• https://github.com/Exiv2/exiv2/pull/1790 · Patch
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-mvc4-g5pv-4qqq · Patch
• https://bdu.fstec.ru/vul/2023-05489 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37623 · Security Note
• https://ubuntu.com/security/CVE-2021-37616 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37620 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37621 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37622 · Security Note
• https://advisories.mageia.org/MGASA-2021-0415.html · Security Note
• https://ubuntu.com/security/CVE-2021-37623 · Vendor Advisory