Lucene search

K
vulnrichmentGitHub_MVULNRICHMENT:CVE-2023-42447
HistorySep 19, 2023 - 2:57 p.m.

CVE-2023-42447 blurhash panics on parsing crafted inputs

2023-09-1914:57:16
CWE-1284
CWE-248
CWE-392
GitHub_M
github.com
cve-2023-42447
blurhash-rs
parsing vulnerability
patch
user intervention
network input
crafted inputs
ascii strings
utf-8 compliance

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

33.0%

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

33.0%

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

Related for VULNRICHMENT:CVE-2023-42447