imgproxy 4.0系にRCE脆弱性、4.0.16で修正
Summary
画像変換サーバーのimgproxy 4.0.0から4.0.15に、細工したICO画像でプロセスが落ちたり、任意のコードを実行されたりする脆弱性があります。4.0.16へ更新し、更新までは到達できる範囲を絞ってください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
画像変換サーバーのimgproxy 4.0.0から4.0.15に、細工したICO画像でプロセスが落ちたり、任意のコードを実行されたりする脆弱性があります。4.0.16へ更新し、更新までは到達できる範囲を絞ってください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| imgproxyimgproxy |
≥ 4.0.0, < 4.0.16→ 4.0.16 |
4.0.16 |
| Gogithub.com/imgproxy/imgproxy/v3 |
All versions→ Not listed |
Not listed |
| Gogithub.com/imgproxy/imgproxy/v2 |
All versions→ Not listed |
Not listed |
| Gogithub.com/imgproxy/imgproxy |
All versions→ Not listed |
Not listed |
| Gogithub.com/imgproxy/imgproxy/v4 |
≥ 4.0.0, < 4.0.16→ 4.0.16 |
4.0.16 |
Original description The description as published by the source.
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com
- web github.com