PT-2024-24370 · Unknown · Imagesharp

Skanejohan · Published 2024-04-15 · Updated 2025-01-09 · CVE-2024-32035

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageSharp versions prior to 2.1.8 ImageSharp versions prior to 3.1.4

Description A vulnerability discovered in the ImageSharp library can lead to excessive memory usage in image decoders when processing specially crafted files. This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, affecting applications and services that rely on ImageSharp for image processing tasks.

Recommendations For versions prior to 2.1.8, update to version 2.1.8 to mitigate the risk of exploitation. For versions prior to 3.1.4, update to version 3.1.4 to mitigate the risk of exploitation. As a temporary workaround, consider using Image.Identify to determine the image dimensions before calling Image.Decode(Async) to enforce a limit and prevent excessive memory usage.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-789

CWE-770

Related Identifiers

CVE-2024-32035

GHSA-G85R-6X2Q-45W7

Affected Products

Imagesharp

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32035.json · Exploit
• https://github.com/SixLabors/ImageSharp/commit/f21d64188e59ae9464ff462056a5e29d8e618b27 · Patch
• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-g85r-6x2q-45w7 · Vendor Advisory
• https://github.com/SixLabors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-32035 · Security Note
• https://osv.dev/vulnerability/GHSA-g85r-6x2q-45w7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32035 · Vendor Advisory
• https://github.com/SixLabors/ImageSharp · Note
• https://t.me/cvenotify/76934 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780008749723165079 · Twitter Post
• https://twitter.com/CVEnew/status/1779966908822905116 · Twitter Post
• https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands · Note
• https://docs.sixlabors.com/articles/imagesharp/security.html · Note
• https://t.me/cvenotify/76865 · Telegram Post