PT-2023-6962 · Golang+3 · Golang+3

Philippe Antoine · Published 2023-08-02 · Updated 2025-06-20 · CVE-2023-29408

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Golang (affected versions not specified) TIFF decoder (affected versions not specified)

Description The issue is related to the decoding of large amounts of compressed data, which can consume excessive memory and CPU. A maliciously-crafted image can exploit this to cause a small image to make the decoder decode large amounts of compressed data. This can lead to a denial of service. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For Golang, consider restricting the use of the TIFF decoder until a patch is available. For the TIFF decoder, as a temporary workaround, consider limiting the size of compressed tile data to prevent excessive memory and CPU consumption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2023-07981

CVE-2023-29408

GHSA-X92R-3VFX-4CV3

GO-2023-1989

OPENSUSE-SU-2024:0194-2

OPENSUSE-SU-2024:13103-1

Affected Products

Debian

Golang

Red Os

Tiff Decoder

References · 31

• https://cve.org/CVERecord?id=CVE-2023-29408 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29408 · Vendor Advisory
• https://pkg.go.dev/vuln/GO-2023-1989 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0194-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2 · Vendor Advisory
• https://go.dev/issue/61582 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07981 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29408 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13103-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1989 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/golang-golang-x-image · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29408 · Vendor Advisory
• https://go.dev/cl/514897 · Patch
• https://osv.dev/vulnerability/CVE-2023-29408 · Vendor Advisory