https://bugzilla.redhat.com/show_bug.cgi?id=2058763
Bug ID: 2058763
Summary: CVE-2022-24614 metadata-extractor: Out-of-memory when
reading a specially crafted JPEG file
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, bibryam(a)redhat.com,
cedric.olivier(a)free.fr, chazlett(a)redhat.com,
drieden(a)redhat.com, emingora(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
mnovotny(a)redhat.com, pantinor(a)redhat.com,
pdelbell(a)redhat.com, pjindal(a)redhat.com,
puntogil(a)libero.it, rguimara(a)redhat.com,
rrajasek(a)redhat.com, tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can
be made to allocate large amounts of memory that finally leads to an
out-of-memory error even for very small inputs. This could be used to mount a
denial of service attack against services that use metadata-extractor library.
Upstream bug:
https://github.com/drewnoakes/metadata-extractor/issues/561
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2058763