CVE-2021-3479: Medium severity OpenEXR OpenEXR vulnerability
Out-of-memory in openexrexrenvmapfuzzer
Other sources
There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/OpenEXRto a version that resolves this vulnerability.Fixed in 3.0.0 - Upgrade
Upgrade
redhat/OpenEXRto a version that resolves this vulnerability.Fixed in 2.4.3 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.0.0-beta
Event History
Frequently Asked Questions
What is CVE-2021-3479?
CVE-2021-3479 is a vulnerability in OpenEXR's Scanline API functionality in versions before 3.0.0-beta.
How does CVE-2021-3479 affect OpenEXR?
CVE-2021-3479 allows an attacker who submits a crafted file to trigger excessive memory consumption in OpenEXR, impacting system availability.
Which software versions are affected by CVE-2021-3479?
Versions before 3.0.0-beta of OpenEXR are affected by CVE-2021-3479. Specifically, OpenEXR 2.4.3, OpenEXR 2.5.0 to 2.5.4, Debian Linux 9.0, and Debian Linux 10.0.
What is the severity of CVE-2021-3479?
CVE-2021-3479 is classified as a medium severity vulnerability with a severity value of 5.5.
How can CVE-2021-3479 be mitigated?
To mitigate CVE-2021-3479, it is recommended to update to OpenEXR version 3.0.0-beta or later.