~ / search / GHSA-j3p8-6mrq-6g7h

GHSA-j3p8-6mrq-6g7h

Golang TIFF decoder vulnerable to excessive CPU consumption

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-29407

Packages

EcosystemPackageAffectedFixed in
Go golang.org/x/image < 0.10.0 0.10.0

Details

As written in the advisory (Markdown source, shown as plain text).

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.

References

External links from the advisory. They lead to third-party sites.