Denial of Service Vulnerability in OpenJPEG Package: CVE-2017-12982
Summary
ALPINE-CVE-2017-12982: The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the op... Affects openjpeg versions < 2.2.0-r1. Fixed in 2.2.0-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source JPEG 2000 codec that provides functionalities for encoding and decoding images in the JPEG 2000 format. It is widely used in various applications for its efficient compression and high-quality image representation. However, it has been found to be vulnerable to a denial of service attack due to improper handling of BMP headers, specifically when the biBitCount is set to zero.
Vulnerability Detail
The vulnerability arises from the bmp_read_info_header function in OpenJPEG version 2.2.0, which fails to reject BMP headers with a zero biBitCount. This oversight allows remote attackers to exploit the vulnerability, leading to a denial of service condition. The attack can cause memory allocation failures in the opj_image_create function, which is critical for image processing. This vulnerability can be exploited without authentication, making it a significant risk for applications utilizing OpenJPEG.
How To Fix
Minimum fixed version
2.2.0-r1
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any BMP files processed by OpenJPEG are validated to confirm that the biBitCount is not zero before processing. This can be done through custom validation scripts that check the BMP header before passing it to OpenJPEG functions.
Conclusion
The OpenJPEG package has a critical vulnerability (CVE-2017-12982) that can lead to denial of service attacks due to improper handling of BMP headers. It is essential to update to the patched version to mitigate risks. For those unable to update immediately, implementing validation checks on BMP files is advised.
See every vulnerability recorded for openjpeg →
FAQ
CVE-2017-12982 is a vulnerability in the OpenJPEG package that allows remote attackers to cause a denial of service due to improper handling of BMP headers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-12982 is 5.5, indicating a moderate severity level.
If an immediate update is not possible, implement validation checks on BMP files to ensure they do not have a zero biBitCount before processing.
More information about OpenJPEG can be found on its official website or its GitHub repository, where you can also find documentation and updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
