PT-2023-6960 · Golang+2 · Golang+2

Philippe Antoine · Published 2023-08-02 · Updated 2023-11-16 · CVE-2023-29407

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Golang (affected versions not specified)

Description The issue is related to excessive CPU consumption during decoding. A maliciously-crafted image, specifically a tiled image with a height of 0 and a very large width, can cause this excessive consumption. This can happen despite the image size appearing to be zero, as the width and height calculation (width * height) would result in zero. This could allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-834

Related Identifiers

BDU:2023-07979

CVE-2023-29407

GHSA-J3P8-6MRQ-6G7H

GO-2023-1990

Affected Products

Debian

Golang

Red Os

References · 24

• https://security-tracker.debian.org/tracker/CVE-2023-29407 · Vendor Advisory
• https://go.dev/issue/61581 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29407 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29407 · Security Note
• https://security-tracker.debian.org/tracker/source-package/golang-golang-x-image · Vendor Advisory
• https://go.dev/cl/514897 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29407 · Security Note
• https://pkg.go.dev/vuln/GO-2023-1990 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07979 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3p8-6mrq-6g7h · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29407 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29407 · Vendor Advisory