CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
71.7%
What kind of vulnerability is it? Who is impacted?
A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.
Has the problem been patched? What versions should users upgrade to?
The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.
Is there a way for users to fix or remediate the vulnerability without upgrading?
Before calling Image.Decode(Async)
, use Image.Identify
to determine the image dimensions in order to enforce a limit.
Are there any links users can visit to find out more?
Vendor | Product | Version | CPE |
---|---|---|---|
* | sixlabors.imagesharp | * | cpe:2.3:a:*:sixlabors.imagesharp:*:*:*:*:*:*:*:* |
docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands
docs.sixlabors.com/articles/imagesharp/security.html
github.com/advisories/GHSA-qxrv-gp6x-rc23
github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515
github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56
github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a
github.com/SixLabors/ImageSharp/pull/2759
github.com/SixLabors/ImageSharp/pull/2764
github.com/SixLabors/ImageSharp/pull/2770
github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23
nvd.nist.gov/vuln/detail/CVE-2024-41132
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
71.7%