GO-2023-1990

Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff

En bref

Publiée: 2023-08-02 15:06 UTC
Mise à jour: 2024-05-20 16:03 UTC
CVE: CVE-2023-29407
Alias: GHSA-j3p8-6mrq-6g7h

Description

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.

Paquets affectés

Paquet	Versions
Go · golang.org/x/image	introduced 0, fixed 0.10.0

Références

https://go.dev/issue/61581 REPORT
https://go.dev/cl/514897 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database