Denial-of-Service Vulnerability in WavPack Package
Summary
ALPINE-CVE-2018-19840: The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because Wa... Affects wavpack versions < 5.1.0-r7. Fixed in 5.1.0-r7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WavPack is an open-source audio compression format that provides lossless and lossy compression. It is widely used for its efficiency in compressing audio files while maintaining quality. However, the package has been found to have a vulnerability that can lead to resource exhaustion, specifically when handling certain audio files.
Vulnerability Detail
The vulnerability arises from the function WavpackPackInit in pack_utils.c within libwavpack.a in WavPack versions up to 5.1.0. Attackers can exploit this vulnerability by crafting a malicious WAV audio file that causes an infinite loop during processing, leading to denial-of-service (DoS) conditions. This results in resource exhaustion, making the application unresponsive and potentially affecting other services running on the same system.
How To Fix
Minimum fixed version
5.1.0-r7
This is the first release that contains the fix.
sudo apk add --upgrade wavpackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing WAV files that are suspected to be crafted or malformed until the package is updated to a secure version.
Conclusion
The WavPack package has a vulnerability that can lead to denial-of-service conditions through crafted audio files. It is crucial to update to the patched versions to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for wavpack →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
WavPack versions up to 5.1.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include denial-of-service conditions, where the application becomes unresponsive, affecting user experience and potentially other services.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wavpack.
