CVE-2023-29408: Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-29408.
What is the severity of CVE-2023-29408?
The severity of CVE-2023-29408 is medium (6.5).
How does the TIFF decoder vulnerability in CVE-2023-29408 work?
The TIFF decoder in CVE-2023-29408 does not place a limit on the size of compressed tile data, allowing a maliciously-crafted image to exploit this and consume excessive memory and CPU by making the decoder decode large amounts of compressed data.
Which software is affected by CVE-2023-29408?
The Golang Image library up to version 0.10.0 is affected by CVE-2023-29408.
How can CVE-2023-29408 be fixed?
To fix CVE-2023-29408, users should update to a version of the Golang Image library beyond 0.10.0 that includes a fix for this vulnerability.