Bug 1491853 (CVE-2017-14229)

Summary: CVE-2017-14229 jasper: excessive looping in jpc_dec_tileinit()
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bmcclain, cfergeau, dblechte, eedri, erik-fedora, jridky, lsurette, mgoldboi, michal.skrivanek, mike, rdieter, rh-spice-bugs, rjones, srevivo, ykaul
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-12-10 21:38:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1491854, 1491855, 1491856    
Bug Blocks: 1449402    

Description Pedro Sampaio 2017-09-14 20:37:47 UTC 
There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of
Jasper 2.0.13. It will lead to a remote denial of service attack.

Upstream bug:

https://github.com/mdadams/jasper/issues/146

References:

https://bugzilla.novell.com/show_bug.cgi?id=1058000
Comment 1 Pedro Sampaio 2017-09-14 20:38:36 UTC 
Created jasper tracking bugs for this issue:

Affects: fedora-all [bug 1491856]


Created mingw-jasper tracking bugs for this issue:

Affects: epel-7 [bug 1491855]
Affects: fedora-all [bug 1491854]
Comment 2 Tomas Hoger 2017-12-05 13:10:07 UTC 
The reproducer provided by the issue reporter does not actually demonstrate an infinite loop.  It does trigger an excessive looping, but processing of the reproducer ends after some time.  It is unclear if infinite looping is possible or not.

This issue remains unfixed in the current upstream version 2.0.14.
Comment 4 Tomas Hoger 2020-12-10 21:38:43 UTC 
Upstream also concluded that there's no infinite loop, only a slow processing due to malicious file triggering large number of memory allocations.