GitHub Advisoryadvisory · npm

GHSA-vjpv-x8p9-7p85 images vulnerable to Denial of Service

HIGH Published 2024-07-10 Modified 2024-07-10 Official page ↗
Aliases
CVE-2024-21523
Ecosystem
npm
Packages
images
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-241, CWE-400
Reviewed
2024-07-10

Affected packages

• npm images: <= 3.2.4 (no fix yet)

Description

All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro, leading to a process crash. Note: By providing some specific integer values (like 0) to the size function, it is possible to obtain a Segmentation fault error, leading to the process crash.

Related

Alias · CVE (1)

  • CVE-2024-21523 All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different… vulnerability

Weakness · CWE (2)

  • CWE-241 Improper Handling of Unexpected Data Type weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References