GitHub Advisoryadvisory · crates.io

GHSA-px9g-8hgv-jvg2 kamadak-exif vulnerable to Infinite loop when parsing PNG files

MEDIUM Published 2022-10-06 Modified 2022-10-06 Official page ↗
Aliases
CVE-2021-21235
Ecosystem
crates.io
Packages
kamadak-exif
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-835
Reviewed
2022-10-06

Affected packages

• crates.io kamadak-exif: >= 0.5.2, < 0.5.3 → fixed in 0.5.3

Description

Impact Reader::read_from_container can cause an infinite loop when a crafted PNG file is given. Patches Version 0.5.3 includes the fix. Workarounds No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected. References • • For more information If you have any questions or comments about this advisory: • Open an issue in github.com/kamadak/exif-rs

Related

Alias · CVE (1)

  • CVE-2021-21235 kamadak-exif is an exif parsing library written in pure Rust. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References