https://bugzilla.redhat.com/show_bug.cgi?id=2058765

Bug ID: 2058765 Summary: CVE-2022-24613 metadata-extractor: Various uncaught exceptions while parsing a specially crafted JPEG file Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: aileenc@redhat.com, alazarot@redhat.com, anstephe@redhat.com, bibryam@redhat.com, cedric.olivier@free.fr, chazlett@redhat.com, drieden@redhat.com, emingora@redhat.com, etirelli@redhat.com, extras-orphan@fedoraproject.org, ggaughan@redhat.com, gmalinko@redhat.com, hbraun@redhat.com, ibek@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jochrist@redhat.com, jolee@redhat.com, jrokos@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, krathod@redhat.com, kverlaen@redhat.com, mnovotny@redhat.com, pantinor@redhat.com, pdelbell@redhat.com, pjindal@redhat.com, puntogil@libero.it, rguimara@redhat.com, rrajasek@redhat.com, tzimanyi@redhat.com Target Milestone: --- Classification: Other

metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.

Upstream bug:

https://github.com/drewnoakes/metadata-extractor/issues/561