OpenJPEG Vulnerability: Use-After-Free in Decompressor
Summary
ALPINE-CVE-2020-15389: jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Affects openjpeg versions < 2.3.1-r4. Fixed in 2.3.1-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source JPEG 2000 codec that allows for encoding and decoding of JPEG 2000 images. It is widely used in various applications for its ability to handle high-quality image compression. However, OpenJPEG versions prior to 2.3.1 are susceptible to a critical vulnerability that can compromise the integrity of the decompression process.
Vulnerability Detail
The vulnerability identified in OpenJPEG is a use-after-free issue located in the jp2/opj_decompress.c file. This flaw can be triggered when the decompressor processes a mix of valid and invalid files within a directory, potentially leading to a double-free scenario. The consequences of this vulnerability include memory corruption, which could be exploited to execute arbitrary code or crash the application. The vulnerability has been assigned the CVE identifier CVE-2020-15389 and has a CVSS score of 6.5, indicating a medium severity level.
How To Fix
Minimum fixed version
2.3.1-r4
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing directories that contain a mix of valid and invalid JPEG 2000 files until the package is updated to a secure version.
Conclusion
The OpenJPEG vulnerability CVE-2020-15389 poses a significant risk due to a use-after-free flaw in the decompressor. Users are advised to update to the latest patched versions to mitigate potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openjpeg →
FAQ
The vulnerability is a use-after-free issue that can lead to memory corruption during the decompression of JPEG 2000 files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploiting this vulnerability may allow an attacker to execute arbitrary code or crash the application, leading to potential data loss or system compromise.
Yes, patches are available in versions 2.3.1-r4 and 2.3.1-r5 for various Alpine versions.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
