https://bugzilla.redhat.com/show_bug.cgi?id=2058765
Bug ID: 2058765
Summary: CVE-2022-24613 metadata-extractor: Various uncaught
exceptions while parsing a specially crafted JPEG file
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, bibryam(a)redhat.com,
cedric.olivier(a)free.fr, chazlett(a)redhat.com,
drieden(a)redhat.com, emingora(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
mnovotny(a)redhat.com, pantinor(a)redhat.com,
pdelbell(a)redhat.com, pjindal(a)redhat.com,
puntogil(a)libero.it, rguimara(a)redhat.com,
rrajasek(a)redhat.com, tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
metadata-extractor up to 2.16.0 can throw various uncaught exceptions while
parsing a specially crafted JPEG file, which could result in an application
crash. This could be used to mount a denial of service attack against services
that use metadata-extractor library.
Upstream bug:
https://github.com/drewnoakes/metadata-extractor/issues/561
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2058765