Critical Remote Denial of Service Vulnerability in OpenJPEG Package
Summary
ALPINE-CVE-2017-14040: An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. Affects openjpeg versions < 2.2.0-r2. Fixed in 2.2.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source library designed for the encoding and decoding of JPEG 2000 images. It is widely used in various applications due to its ability to handle high-quality image formats efficiently. However, like many software packages, it is susceptible to vulnerabilities that can compromise its functionality and security. This particular vulnerability affects multiple versions of OpenJPEG across various Alpine Linux distributions.
Vulnerability Detail
An invalid write access was discovered in the bin/jp2/convert.c file of OpenJPEG version 2.2.0. This flaw can trigger a crash in the tgatoimage function, potentially leading to a remote denial of service (DoS) attack. The vulnerability may also result in unspecified other impacts, making it critical for users to address it promptly. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected function until the package is updated. This may involve modifying the application code to bypass calls to tgatoimage or using alternative image processing libraries that do not exhibit this vulnerability.
Conclusion
The OpenJPEG vulnerability identified as CVE-2017-14040 poses a significant risk due to its potential to cause remote denial of service attacks. Users are strongly encouraged to update to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for openjpeg →
FAQ
OpenJPEG is an open-source library for encoding and decoding JPEG 2000 images, widely used in various applications for its efficiency and high-quality output.
The vulnerability involves an invalid write access that can lead to a crash in the tgatoimage function, resulting in a potential remote denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a high severity level that requires immediate attention.
You can update the OpenJPEG package by running the command 'apk add openjpeg@2.2.0-r2' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
