CVE-2021-21235 - OpenCVE

kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:M/Au:N/C:N/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Kamadak-exif Project	Kamadak-exif

Configuration 1 [-]

cpe:2.3:a:kamadak-exif_project:kamadak-exif:0.5.2:*:*:*:*:rust:*:*

No data.

References

Link	Providers
https://crates.io/crates/kamadak-exif
https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48
https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-01-06T01:15:14

Updated: 2024-08-03T18:09:14.897Z

Reserved: 2020-12-22T00:00:00

Link: CVE-2021-21235

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-01-06T02:15:12.967

Modified: 2022-10-19T13:00:59.627

Link: CVE-2021-21235

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "exif-rs", "vendor": "kamadak", "versions": [{"status": "affected", "version": "= 0.5.2"}]}], "descriptions": [{"lang": "en", "value": "kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-06T01:15:14", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2"}, {"tags": ["x_refsource_MISC"], "url": "https://crates.io/crates/kamadak-exif"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48"}], "source": {"advisory": "GHSA-px9g-8hgv-jvg2", "discovery": "UNKNOWN"}, "title": "Infinite loop in parsing PNG files in", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-21235", "STATE": "PUBLIC", "TITLE": "Infinite loop in parsing PNG files in"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "exif-rs", "version": {"version_data": [{"version_value": "= 0.5.2"}]}}]}, "vendor_name": "kamadak"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400: Uncontrolled Resource Consumption"}]}]}, "references": {"reference_data": [{"name": "https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2", "refsource": "CONFIRM", "url": "https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2"}, {"name": "https://crates.io/crates/kamadak-exif", "refsource": "MISC", "url": "https://crates.io/crates/kamadak-exif"}, {"name": "https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48", "refsource": "MISC", "url": "https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48"}]}, "source": {"advisory": "GHSA-px9g-8hgv-jvg2", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:09:14.897Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://crates.io/crates/kamadak-exif"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-21235", "datePublished": "2021-01-06T01:15:14", "dateReserved": "2020-12-22T00:00:00", "dateUpdated": "2024-08-03T18:09:14.897Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kamadak-exif_project:kamadak-exif:0.5.2:*:*:*:*:rust:*:*", "matchCriteriaId": "58DB84D2-C8B6-43E8-96C1-AE01E3B3ACF8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected."}, {"lang": "es", "value": "kamadak-exif es una biblioteca de an\u00e1lisis exif escrita en Rust puro. En kamadak-exif versi\u00f3n 0.5.2, Se presenta un bucle infinito en el an\u00e1lisis de archivos PNG dise\u00f1ados. Espec\u00edficamente, la funci\u00f3n reader::read_from_container puede causar un bucle infinito cuando se le proporciona un archivo PNG dise\u00f1ado. Esto es corregido en la versi\u00f3n 0.5.3. Ninguna soluci\u00f3n alternativa est\u00e1 disponible. Las aplicaciones que no aprueban archivos con la firma PNG a la funci\u00f3n Reader::read_from_container no est\u00e1n afectadas"}], "id": "CVE-2021-21235", "lastModified": "2022-10-19T13:00:59.627", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-01-06T02:15:12.967", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Third Party Advisory"], "url": "https://crates.io/crates/kamadak-exif"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/kamadak/exif-rs/commit/f21df24616ea611c5d5d0e0e2f8042eb74d5ff48"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}