Denial of Service Vulnerability in FFmpeg Package
Summary
ALPINE-CVE-2017-14058: In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop). Affects ffmpeg versions < 3.1.11-r0. Fixed in 3.1.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports various formats and codecs, making it a versatile tool for media processing. However, certain versions of FFmpeg are vulnerable to a denial of service attack due to improper handling of reload attempts in the HLS (HTTP Live Streaming) protocol.
Vulnerability Detail
The vulnerability identified as CVE-2017-14058 affects FFmpeg versions 2.4 and 3.3.3, specifically within the read_data function in libavformat/hls.c. This function does not adequately restrict reload attempts for an insufficient list, allowing remote attackers to exploit this flaw and trigger an infinite loop. The consequence of this vulnerability is a denial of service, rendering the application unresponsive and potentially affecting any services relying on FFmpeg for media processing.
How To Fix
Minimum fixed version
3.1.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the FFmpeg service or disabling the HLS functionality until the package can be updated. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
The CVE-2017-14058 vulnerability in FFmpeg poses a significant risk of denial of service due to improper handling of reload attempts. It is crucial for users to update to the patched versions of the package to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-14058 is a vulnerability in FFmpeg that allows remote attackers to cause a denial of service due to an infinite loop in the read_data function.
FFmpeg versions 2.4 and 3.3.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
If an immediate update is not possible, consider implementing access restrictions or disabling the HLS functionality as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
