Allocation of Resources Without Limits or Throttling Affecting golang.org/x/image/tiff package, versions <0.10.0
Threat Intelligence
EPSS
0.15% (53rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GOLANGORGXIMAGETIFF-5816822
- published 3 Aug 2023
- disclosed 2 Aug 2023
- credit Philippe Antoine
Introduced: 2 Aug 2023
CVE-2023-29408 Open this link in a new tabHow to fix?
Upgrade golang.org/x/image/tiff to version 0.10.0 or higher.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Decode() and DecodeConfig() functions. The TIFF decoder does not place a limit on the size of compressed tile data. An attacker can exploit this by sending a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
References
CVSS Scores
version 3.1