Critical Vulnerability in OpenJPEG Package: CVE-2020-27823
Summary
ALPINE-CVE-2020-27823: A flaw was found in OpenJPEG’s encoder. Affects openjpeg versions < 2.3.1-r5. Fixed in 2.3.1-r5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source JPEG 2000 codec that provides functionalities for encoding and decoding images in the JPEG 2000 format. It is widely used in various applications for its efficient compression and high-quality image output. However, the package has been found to have a vulnerability that can be exploited, potentially compromising the confidentiality, integrity, and availability of systems utilizing this library.
Vulnerability Detail
A flaw was discovered in OpenJPEG's encoder, allowing attackers to pass specially crafted x,y offset inputs during encoding. This vulnerability can lead to severe consequences, including unauthorized access to sensitive data, data corruption, and system crashes. The vulnerability is classified under CVE-2020-27823, with a CVSS score of 7.8, indicating a high level of risk.
How To Fix
Minimum fixed version
2.3.1-r5
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the OpenJPEG encoder functionality or implementing input validation to mitigate the risk of exploitation until the package can be updated.
Conclusion
The OpenJPEG package has a critical vulnerability (CVE-2020-27823) that can be exploited through its encoder. It is crucial to update to the patched versions to mitigate risks associated with this vulnerability. Regular monitoring and vulnerability management practices are essential to maintain system security.
See every vulnerability recorded for openjpeg →
FAQ
CVE-2020-27823 is a vulnerability in the OpenJPEG package that allows attackers to exploit the encoder by passing specially crafted inputs.
The vulnerability can lead to unauthorized access to sensitive data, data corruption, and system crashes, affecting confidentiality, integrity, and availability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2020-27823 is 7.8, indicating a high level of risk.
To update the OpenJPEG package, use the command: apk add openjpeg@2.3.1-r6 for Alpine v3.12 and later versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
