Bug 1800472 (CVE-2019-20421)

Summary:	CVE-2019-20421 exiv2: infinite loop and hang in Jp2Image::readMetadata() in jp2image.cpp could lead to DoS
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jgrulich, michel, mpoole, rdieter
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A denial of service vulnerability was found in exiv2 in the way JPEG 2000 (JP2) metadata was read when processing an image file. A remote attacker could abuse this flaw to create a specially crafted image, causing exiv2 to enter into an infinite loop when processing an incoming malicious image.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-02-25 21:49:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1800473, 1807380
Bug Blocks:	1800474

Description Marian Rehak 2020-02-07 07:59:43 UTC

In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

Upstream Issue:

https://github.com/Exiv2/exiv2/issues/1011

Upstream Fix:

https://github.com/Exiv2/exiv2/commit/a82098f4f90cd86297131b5663c3dec6a34470e8

Comment 1 Marian Rehak 2020-02-07 07:59:58 UTC

Created exiv2 tracking bugs for this issue:

Affects: fedora-all [bug 1800473]

Comment 3 Mauro Matteo Cascella 2020-02-25 19:21:36 UTC

The flaw seems to be introduced in exiv2 upstream version v0.27.2 after commit https://github.com/Exiv2/exiv2/commit/edb4bf78ca5820f2c7a852c8f2df11e6aba45704.

This commit added a new check in function MemIo::seek() in basicio.cpp which made it possible to return without setting variable p_->idx_, thus causing the infinite loop in the calling function Jp2Image::readMetadata() in jp2image.cpp.

Comment 4 Mauro Matteo Cascella 2020-02-25 19:35:53 UTC

Statement:

This flaw did not affect the versions of exiv2 as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include the vulnerable code, which was introduced in a later version of the library.

Comment 5 Product Security DevOps Team 2020-02-25 21:49:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-20421

Comment 7 errata-xmlrpc 2020-04-28 15:27:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1577 https://access.redhat.com/errata/RHSA-2020:1577