PT-2023-32978 · Libwebp+2 · Libwebp+2

Published 2023-11-16 · Updated 2023-11-16

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sharp versions prior to 0.32.6

Description The issue affects sharp, which uses libwebp to decode WebP images. Almost anyone processing untrusted input with versions of sharp prior to 0.32.6 is affected.

Recommendations For sharp versions prior to 0.32.6, upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2. If using a globally-installed libvips, ensure you are using the latest libwebp 1.3.2. As a temporary workaround, consider adding sharp.block({ operation: ["VipsForeignLoadWebp"] }); to your code to prevent sharp from decoding WebP images.

Fix

Related Identifiers

GHSA-54XQ-CGQR-RPM3

Affected Products

Libvips

Libwebp

Sharp

References · 4

• https://osv.dev/vulnerability/GHSA-54xq-cgqr-rpm3 · Vendor Advisory
• https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3 · Note
• https://github.com/lovell/sharp · Note
• https://github.com/lovell/sharp/commit/dbce6fab795ca4250bda9b1ef502c1fdb7d4a30c · Note