Heap-Based Buffer Overflow in OpenJPEG Package: CVE-2020-6851
Summary
ALPINE-CVE-2020-6851: OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation. Affects openjpeg versions < 2.3.1-r3. Fixed in 2.3.1-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source library that provides a comprehensive implementation of the JPEG 2000 image coding system. It is widely used for encoding and decoding images in various applications due to its efficient compression and high-quality output. However, the library has been found to have a critical vulnerability that can lead to severe security issues if not addressed promptly.
Vulnerability Detail
OpenJPEG through version 2.3.1 has a heap-based buffer overflow vulnerability in the function opj_t1_clbl_decode_processor located in openjp2/t1.c. This issue arises from a lack of validation in the opj_j2k_update_image_dimensions function, which can allow an attacker to exploit the vulnerability by sending specially crafted input. The ramifications of this vulnerability include potential arbitrary code execution, leading to system compromise and unauthorized access to sensitive data. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.3.1-r3
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation on the data being processed by OpenJPEG to mitigate the risk of exploitation. This can help prevent malformed data from reaching the vulnerable function.
Conclusion
The OpenJPEG library has a critical vulnerability (CVE-2020-6851) that can lead to severe security risks if not addressed. Users are strongly advised to update to the patched version to protect their systems from potential exploitation. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of open-source software.
See every vulnerability recorded for openjpeg →
FAQ
CVE-2020-6851 is a vulnerability in the OpenJPEG library that allows for a heap-based buffer overflow, potentially leading to arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, allowing attackers to gain unauthorized access to systems and sensitive data.
Yes, the patched version of OpenJPEG is 2.3.1-r3 or later. Users should update to this version to mitigate the vulnerability.
The CVSS score for CVE-2020-6851 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
