Buffer Overflow Vulnerability in OpenJPEG Package: CVE-2020-27824
Summary
ALPINE-CVE-2020-27824: A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. Affects openjpeg versions < 2.3.1-r5. Fixed in 2.3.1-r5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source JPEG 2000 codec that provides a comprehensive implementation for encoding and decoding JPEG 2000 images. It is widely used in various applications due to its ability to handle high-quality image compression and decompression. However, it has been found to be vulnerable to a buffer overflow issue in its encoder, specifically in the opj_dwt_calc_explicit_stepsizes() function, which can be exploited by attackers.
Vulnerability Detail
A flaw was discovered in the OpenJPEG encoder that allows an attacker to supply crafted input to the decomposition levels, leading to a buffer overflow. This vulnerability can potentially compromise system availability, as it may allow an attacker to execute arbitrary code or crash the application. The vulnerability is identified as CVE-2020-27824 and has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.3.1-r5
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the application or disabling features that utilize OpenJPEG until the vulnerability can be addressed.
Conclusion
The OpenJPEG package has a critical vulnerability (CVE-2020-27824) that can lead to buffer overflow issues, potentially compromising system availability. It is essential to update to the patched versions to mitigate this risk. Regular monitoring and vulnerability assessments, such as those provided by Vulert, can help maintain software security.
See every vulnerability recorded for openjpeg →
FAQ
CVE-2020-27824 is a vulnerability in the OpenJPEG package that allows for a buffer overflow due to improper handling of crafted input in the encoder.
Exploitation of this vulnerability can lead to system crashes or arbitrary code execution, impacting the availability and security of your application.
All versions of OpenJPEG prior to the patched versions (2.3.1-r5 for Alpine v3.10 and v3.11, and 2.3.1-r6 for Alpine v3.12 and later) are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json, ensuring your software remains secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
