CVE-2020-27828: Input Validation
Heap buffer overflow to out of bounds write in the jpc encoder's cpcreate() routine when resolution levels are greater than max.
Reference: https://github.com/jasper-software/jasper/issues/252
Upstream patch: https://github.com/jasper-software/jasper/pull/253
Other sources
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jasperto a version that resolves this vulnerability.Fixed in 2.0.23 - Upgrade
Upgrade
jasperto a version that resolves this vulnerability.Fixed in 2.0.23
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in jasper's jpc encoder?
The vulnerability ID for this flaw in jasper's jpc encoder is CVE-2020-27828.
What is the severity of CVE-2020-27828?
CVE-2020-27828 has a severity rating of 7.8 (high).
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by providing crafted input to jasper's jpc encoder, causing an arbitrary out-of-bounds write.
Which versions of jasper are affected by this vulnerability?
Versions of jasper prior to 2.0.23 are affected by this vulnerability.
How can I fix this vulnerability in jasper's jpc encoder?
To fix this vulnerability, upgrade jasper to version 2.0.23 or later.