[Bug 2058763] New: CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially crafted JPEG file
https://bugzilla.redhat.com/show_bug.cgi?id=2058763
Bug ID: 2058763 Summary: CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially crafted JPEG file Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: aileenc@redhat.com, alazarot@redhat.com, anstephe@redhat.com, bibryam@redhat.com, cedric.olivier@free.fr, chazlett@redhat.com, drieden@redhat.com, emingora@redhat.com, etirelli@redhat.com, extras-orphan@fedoraproject.org, ggaughan@redhat.com, gmalinko@redhat.com, hbraun@redhat.com, ibek@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jochrist@redhat.com, jolee@redhat.com, jrokos@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, krathod@redhat.com, kverlaen@redhat.com, mnovotny@redhat.com, pantinor@redhat.com, pdelbell@redhat.com, pjindal@redhat.com, puntogil@libero.it, rguimara@redhat.com, rrajasek@redhat.com, tzimanyi@redhat.com Target Milestone: --- Classification: Other
When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.
Upstream bug:
https://github.com/drewnoakes/metadata-extractor/issues/561
https://bugzilla.redhat.com/show_bug.cgi?id=2058763
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2058768
https://bugzilla.redhat.com/show_bug.cgi?id=2058763
Patrick Del Bello pdelbell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2068597
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2068597 [Bug 2068597] CVE-2022-24614 metadata-extractor2: metadata-extractor: Out-of-memory when reading a specially crafted JPEG file [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=2058763
--- Comment #1 from Patrick Del Bello pdelbell@redhat.com --- Created metadata-extractor2 tracking bugs for this issue:
Affects: epel-7 [bug 2068597]
https://bugzilla.redhat.com/show_bug.cgi?id=2058763
--- Comment #6 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.11
Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
https://bugzilla.redhat.com/show_bug.cgi?id=2058763
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5532
https://bugzilla.redhat.com/show_bug.cgi?id=2058763
--- Comment #7 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2022-24614
https://bugzilla.redhat.com/show_bug.cgi?id=2058763
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |ERRATA Status|NEW |CLOSED Last Closed| |2022-07-07 19:38:15
https://bugzilla.redhat.com/show_bug.cgi?id=2058763 Bug 2058763 depends on bug 2068597, which changed state.
Bug 2068597 Summary: CVE-2022-24614 metadata-extractor2: metadata-extractor: Out-of-memory when reading a specially crafted JPEG file [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2068597
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com