CVE-2023-29407
MEDIUMgolang/image < 0.10.0 - Excessive Iteration via Malicious Tiled Image
Title source: llmDescription
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
References (7)
Core 7
Core References
Patch
https://go.dev/cl/514897
Issue Tracking, Vendor Advisory
https://go.dev/issue/61581
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/
Issue Tracking, Patch, Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1990
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230831-0009/
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/
Scores
CVSS v3
6.5
EPSS
0.0080
EPSS Percentile
51.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-834
Status
published
Products (4)
fedoraproject/fedora
37
fedoraproject/fedora
38
golang/image
< 0.10.0
x/image
0 - 0.10.0Go
Published
Aug 02, 2023
Tracked Since
Feb 18, 2026