CVE-2023-29407
published 2023-08-02CVE-2023-29407: A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU…
PriorityP428medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.80%
52.7th percentile
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | golang-golang-x-image | < golang-golang-x-image 0.11.0-1 (forky) | golang-golang-x-image 0.11.0-1 (forky) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| golang.org | x_image | >= 0 < 0.10.0 | 0.10.0 |
| golang.org | x_image_golang.org_x_image_tiff | < 0.10.0 | 0.10.0 |
| golang | image | < 0.10.0 | 0.10.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Golang TIFF decoder vulnerable to excessive CPU consumption
ghsa·2023-08-02
CVE-2023-29407 [MEDIUM] CWE-834 Golang TIFF decoder vulnerable to excessive CPU consumption
Golang TIFF decoder vulnerable to excessive CPU consumption
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
OSV
CVE-2023-29407: A maliciously-crafted image can cause excessive CPU consumption in decoding
osv·2023-08-02·CVSS 6.5
CVE-2023-29407 [MEDIUM] CVE-2023-29407: A maliciously-crafted image can cause excessive CPU consumption in decoding
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
OSV
Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
osv·2023-08-02
CVE-2023-29407 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
A maliciously-crafted image can cause excessive CPU consumption in decoding.
A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
OSV
Golang TIFF decoder vulnerable to excessive CPU consumption
osv·2023-08-02
CVE-2023-29407 [MEDIUM] Golang TIFF decoder vulnerable to excessive CPU consumption
Golang TIFF decoder vulnerable to excessive CPU consumption
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
Red Hat
golang.org/x/image/tiff: excessive CPU consumption in decoding
vendor_redhat·2023-08-02·CVSS 6.5
CVE-2023-29407 [MEDIUM] CWE-834 golang.org/x/image/tiff: excessive CPU consumption in decoding
golang.org/x/image/tiff: excessive CPU consumption in decoding
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
A flaw was found in the Golang tiff package, where it is vulnerable to a denial of service caused by an excessive iteration flaw. By persuading a victim to open a specially crafted image file, a remote attacker can cause excessive CPU consumption in decoding, resulting in a denial of service condition.
Package: acm-cluster-templates-operator-container (Red Hat Advanced Cluster Management for Kubernetes 2) - Will not fix
Debian
CVE-2023-29407: golang-golang-x-image - A maliciously-crafted image can cause excessive CPU consumption in decoding. A t...
vendor_debian·2023·CVSS 6.5
CVE-2023-29407 [MEDIUM] CVE-2023-29407: golang-golang-x-image - A maliciously-crafted image can cause excessive CPU consumption in decoding. A t...
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.11.0-1)
sid: resolved (fixed in 0.11.0-1)
trixie: resolved (fixed in 0.11.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://go.dev/cl/514897https://go.dev/issue/61581https://lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/https://lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/https://lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/https://pkg.go.dev/vuln/GO-2023-1990https://security.netapp.com/advisory/ntap-20230831-0009/https://go.dev/cl/514897https://go.dev/issue/61581https://lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/https://lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/https://lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/https://pkg.go.dev/vuln/GO-2023-1990https://security.netapp.com/advisory/ntap-20230831-0009/
2023-08-02
Published