PT-2022-7119 · Unknown+2 · Openimageio+2

Lilith >_> · Published 2022-02-07 · Updated 2024-06-15 · CVE-2023-24472

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.7.1

Description A denial of service issue exists in the FitsOutput::close() functionality of OpenImageIO, related to uncontrolled recursion. This can be triggered by a specially crafted ImageOutput Object, allowing a remote attacker to cause a denial of service with a maliciously created image file. An attacker can provide malicious input to trigger this vulnerability.

Recommendations For OpenImageIO version 2.4.7.1, consider disabling the FitsOutput::close() function until a patch is available to prevent exploitation. Restrict access to the ImageOutput object to minimize the risk of denial of service attacks. Avoid using specially crafted image files that could trigger this issue until the vulnerability is resolved.

Exploit

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

BDU:2023-07641

CVE-2023-24472

DLA-3518-1

MGASA-2023-0151

OPENSUSE-SU-2024:12693-1

Affected Products

Astra Linux

Debian

Openimageio

References · 29

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1709 · Exploit
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12693-1 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-24472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24472 · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0151 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-24472 · Vendor Advisory
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LK6TY36VQ3FQXMZ2VXHZGQ43VDLD67GG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/T3LET4MEPBSBJZK4EMLEBY4FUXKU5BMN · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24472 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3518-1 · Vendor Advisory