Critical Out-of-Bounds Write Vulnerability in OpenJPEG Package
Summary
ALPINE-CVE-2020-27844: A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. Affects openjpeg versions < 2.4.0-r0. Fixed in 2.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source JPEG 2000 codec that provides functionalities for encoding and decoding images in the JPEG 2000 format. It is widely used in various applications due to its efficiency and support for high-quality image processing. However, versions prior to 2.4.0 contain a critical vulnerability that exposes systems to potential attacks through crafted input during conversion and encoding processes.
Vulnerability Detail
A flaw was identified in OpenJPEG's source code, specifically in the file src/lib/openjp2/t2.c, affecting all versions prior to 2.4.0. This vulnerability allows an attacker to exploit the software by providing specially crafted input, leading to an out-of-bounds write. The consequences of this vulnerability can severely impact confidentiality, integrity, and availability of the system, making it a high-risk issue for users of the affected versions.
How To Fix
Minimum fixed version
2.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using OpenJPEG for processing untrusted or potentially malicious input until the package is updated to the fixed version. Additionally, implementing input validation can help mitigate the risk of exploitation.
Conclusion
The OpenJPEG package has a critical vulnerability that allows for out-of-bounds writes, posing significant risks to systems using affected versions. Users are strongly advised to update to version 2.4.0 or later to mitigate these risks. For ongoing monitoring of vulnerabilities, tools like Vulert can be beneficial.
See every vulnerability recorded for openjpeg →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
All versions of OpenJPEG prior to 2.4.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to out-of-bounds writes, which may compromise the confidentiality, integrity, and availability of the system.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
