Vulnerability Details CVE-2023-29407
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.3%
CVSS Severity
CVSS v3 Score 6.5
References
- https://go.dev/cl/514897
- https://go.dev/issue/61581
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/
- https://pkg.go.dev/vuln/GO-2023-1990
- https://security.netapp.com/advisory/ntap-20230831-0009/
- https://go.dev/cl/514897
- https://go.dev/issue/61581
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/
- https://pkg.go.dev/vuln/GO-2023-1990
- https://security.netapp.com/advisory/ntap-20230831-0009/
Products affected by CVE-2023-29407
-
cpe:2.3:a:golang:image:0.1.0
-
cpe:2.3:a:golang:image:0.2.0
-
cpe:2.3:a:golang:image:0.3.0
-
cpe:2.3:a:golang:image:0.4.0
-
cpe:2.3:a:golang:image:0.5.0
-
cpe:2.3:a:golang:image:0.6.0
-
cpe:2.3:a:golang:image:0.7.0
-
cpe:2.3:a:golang:image:0.8.0
-
cpe:2.3:a:golang:image:0.9.0
-
cpe:2.3:o:fedoraproject:fedora:37
-
cpe:2.3:o:fedoraproject:fedora:38