Integer Index Out of Range Vulnerability in golang-github-disintegration-imaging Package
Summary
DEBIAN-CVE-2023-36308: disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. Affects golang-github-disintegration-imaging versions < 1.6.2-3. Fixed in 1.6.2-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang-github-disintegration-imaging package is a widely used library in the Go programming language that provides image processing capabilities, including functions for manipulating and converting images. This package is essential for developers who require advanced image handling features in their applications. However, it has been identified that version 1.6.2 of this package is vulnerable to a specific issue that can lead to application crashes when processing certain TIFF files.
Vulnerability Detail
The vulnerability arises from an integer index out of range error that occurs during a Grayscale call in the scan function of scanner.go. Attackers can exploit this vulnerability by providing a specially crafted TIFF file, which can cause the application to panic and potentially disrupt service. While it is unclear if this panic could lead to further security implications, the risk of application instability is significant.
How To Fix
Minimum fixed version
1.6.2-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-github-disintegration-imagingTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted TIFF files with the golang-github-disintegration-imaging package until the package is updated to a secure version. Implementing input validation to check the integrity of TIFF files before processing may also help mitigate the risk.
Conclusion
The golang-github-disintegration-imaging package has a critical vulnerability that can lead to application crashes when handling certain TIFF files. It is essential for users of this package to update to the patched version to ensure stability and security. Until an update can be applied, users should take precautions to avoid processing untrusted files.
See every vulnerability recorded for golang-github-disintegration-imaging →
FAQ
The vulnerability is an integer index out of range error that can cause application crashes when processing certain TIFF files.
Versions prior to 1.6.2-3 of the golang-github-disintegration-imaging package are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, avoid processing untrusted TIFF files and implement input validation as a temporary measure.
More details can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-36308.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-disintegration-imaging.
