Denial of Service Vulnerability in OpenJPEG Package: CVE-2019-12973
Summary
ALPINE-CVE-2019-12973: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Affects openjpeg versions < 2.3.1-r4. Fixed in 2.3.1-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source library for handling JPEG 2000 image compression. It is widely used in various applications for its ability to efficiently encode and decode images. The library supports multiple platforms and is known for its performance and compliance with JPEG 2000 standards. However, it has been found to be vulnerable to a denial of service attack due to excessive iteration in its encoding function, which can be exploited by attackers.
Vulnerability Detail
In OpenJPEG version 2.3.1, a vulnerability exists in the opj_t1_encode_cblks function located in openjp2/t1.c. This flaw allows remote attackers to cause a denial of service by sending a specially crafted BMP file. The excessive iteration in the encoding process can lead to resource exhaustion, making the application unresponsive. This vulnerability is similar to CVE-2018-6616 and has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.3.1-r4
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted BMP files until the package is updated to a secure version.
Conclusion
The OpenJPEG library has a vulnerability (CVE-2019-12973) that can lead to denial of service through crafted BMP files. Users are advised to update to the latest patched versions to mitigate this risk. Monitoring tools like Vulert can help keep applications secure against such vulnerabilities.
See every vulnerability recorded for openjpeg →
FAQ
CVE-2019-12973 is a vulnerability in the OpenJPEG library that can lead to denial of service through excessive iteration in the encoding process.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can cause the application to become unresponsive, leading to service downtime and potential data loss.
Yes, a patched version of OpenJPEG is available. Users should update to version 2.3.1-r4 or 2.3.1-r5 depending on their Alpine version.
You can use the Vulert playground at Vulert Scanner to check your application for vulnerabilities without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
