PT-2024-5252 · Unknown · Imagesharp

Erazerbrecht · Published 2024-06-26 · Updated 2024-09-11 · CVE-2024-41132

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: ImageSharp versions prior to 3.1.5 ImageSharp versions prior to 2.1.9

Description: A vulnerability in the ImageSharp library can lead to excessive memory usage in the Gif decoder when processing specially crafted files. This issue is triggered when ImageSharp attempts to process image files designed to exploit this flaw. The vulnerability may allow a remote attacker to cause a denial of service.

Recommendations: For versions prior to 3.1.5, upgrade to v3.1.5. For versions prior to 2.1.9, upgrade to v2.1.9. As a temporary workaround, before calling Image.Decode(Async), use Image.Identify to determine the image dimensions in order to enforce a limit.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-789

CWE-770

Related Identifiers

BDU:2024-05864

CVE-2024-41132

GHSA-QXRV-GP6X-RC23

Affected Products

Imagesharp

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41132.json · Exploit
• https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515 · Patch
• https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56 · Patch
• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23 · Vendor Advisory
• https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-41132 · Security Note
• https://bdu.fstec.ru/vul/2024-05864 · Security Note
• https://osv.dev/vulnerability/GHSA-qxrv-gp6x-rc23 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41132 · Vendor Advisory
• https://github.com/SixLabors/ImageSharp · Note
• https://github.com/SixLabors/ImageSharp/pull/2764 · Note
• https://github.com/SixLabors/ImageSharp/pull/2759 · Note
• https://github.com/SixLabors/ImageSharp/pull/2770 · Note
• https://docs.sixlabors.com/articles/imagesharp/security.html · Note
• https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands · Note