CVE-2021-3443: Null Pointer Dereference
A flaw was found in jasper before 2.0.26. A NULL pointer dereference in jp2decode in jp2dec.c may lead to program crash and denial of service.
Reference: https://github.com/jasper-software/jasper/issues/269
Upstream patch: https://github.com/jasper-software/jasper/commit/f94e7499a8b1471a4905c4f9c9e12e60fe88264b
Other sources
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jasperto a version that resolves this vulnerability.Fixed in 2.0.27 - Upgrade
Upgrade
jasper-software/jasperto a version that resolves this vulnerability.Fixed in 2.0.27Patch f94e7499a8b1471a4905c4f9c9e12e60fe88264b - Compensating control
If you must process untrusted JP2 files, treat JP2 parsing as untrusted input and isolate the Jasper-using application/service (e.g., run it with restricted privileges or in an isolated environment) to reduce impact of a potential denial-of-service crash.
Event History
Frequently Asked Questions
What is CVE-2021-3443?
CVE-2021-3443 is a vulnerability found in the Jasper library, specifically versions before 2.0.27.
How does CVE-2021-3443 affect systems?
CVE-2021-3443 can cause a crash in an application that uses the Jasper library when opening a specially crafted JP2 image file.
Which software versions are affected by CVE-2021-3443?
Versions before 2.0.27 of the Jasper library are affected by CVE-2021-3443.
What is the severity of CVE-2021-3443?
CVE-2021-3443 has a severity value of 5.5, which is considered medium.
How can I fix CVE-2021-3443?
To fix CVE-2021-3443, update your Jasper library to version 2.0.27 or later.