Information Disclosure Vulnerability in OpenImageIO Package
Summary
DEBIAN-CVE-2023-24473: An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project OpenImageIO v2.4.7.1. Affects openimageio versions < 2.4.13.0+dfsg-1. Fixed in 2.4.13.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenImageIO is an open-source library designed for reading and writing images in various formats. It provides a powerful and flexible API for image processing and is widely used in graphics applications. The library supports multiple image formats, including TGA, which is the focus of this vulnerability. The specific issue arises in the TGAInput::read_tga2_header functionality, where improper handling of specially crafted TGA files can lead to sensitive information being disclosed.
Vulnerability Detail
An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project OpenImageIO v2.4.7.1. This vulnerability allows an attacker to craft a malicious TGA file that, when processed by the library, can lead to the disclosure of sensitive information. The issue originates from inadequate validation of the TGA file structure, which can expose memory contents or other sensitive data to unauthorized users. This could potentially lead to further exploitation if sensitive information is revealed.
How To Fix
Minimum fixed version
2.4.13.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openimageioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or unknown TGA files until the package is updated. Implementing file validation checks before processing can also help mitigate the risk of exploitation.
Conclusion
The information disclosure vulnerability in OpenImageIO poses a significant risk by allowing attackers to exploit specially crafted TGA files to access sensitive information. It is crucial for users to update to the patched version to mitigate this risk and to implement best practices for file handling in the meantime.
See every vulnerability recorded for openimageio →
FAQ
The vulnerability is an information disclosure issue that allows sensitive data to be exposed through specially crafted TGA files.
The affected versions are OpenImageIO v2.4.7.1 and earlier.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code.
If immediate updates are not possible, avoid processing untrusted TGA files and implement validation checks to mitigate risks.
More information can be found in the official vulnerability report at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-24473.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for openimageio.
