Critical Denial of Service Vulnerability in File Package (CVE-2019-8907)
Summary
ALPINE-CVE-2019-8907: do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact. Affects file versions < 5.36-r0. Fixed in 5.36-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'file' package is a widely used utility in Unix-like operating systems that determines the type of a file by examining its contents. It is essential for various applications that rely on file type identification for processing and handling files correctly. However, the package has been found to contain a vulnerability that can lead to severe security issues, including application crashes and potential exploitation by remote attackers.
Vulnerability Detail
The vulnerability, identified as CVE-2019-8907, originates from the 'do_core_note' function in the 'readelf.c' file within the libmagic.a library of the 'file' package version 5.35. This flaw allows remote attackers to cause a denial of service through stack corruption, leading to application crashes. The impact of this vulnerability can be significant, as it may allow attackers to disrupt services or exploit the application further, although specific exploit details remain unspecified.
How To Fix
Minimum fixed version
5.36-r0
This is the first release that contains the fix.
sudo apk add --upgrade fileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the affected application or service to trusted users only. Additionally, monitoring logs for unusual activity may help identify potential exploitation attempts.
Conclusion
The CVE-2019-8907 vulnerability in the 'file' package poses a significant risk to systems using affected versions. It is crucial to update to the patched version 5.36-r0 to mitigate this risk. Users should also consider temporary workarounds and monitor their systems for any suspicious activity until the update can be applied.
See every vulnerability recorded for file →
FAQ
CVE-2019-8907 is a critical vulnerability in the 'file' package that can lead to denial of service through stack corruption.
This vulnerability can cause application crashes and may allow remote attackers to disrupt services or exploit the application.
The CVSS score for CVE-2019-8907 is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider implementing access restrictions and monitoring for unusual activity as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for file.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
