GHSA-24cc-9352-h2pg: Medium severity pip/tinytag vulnerability
Impact An M4A file containing a sub-atom with a size of zero in the ---- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.
Patches The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks.
Workarounds No workarounds exist. Users must upgrade to tinytag 2.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tinytagto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
tinytagto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
What input is required to trigger the denial of service?
An attacker needs to provide an M4A file containing a zero-size sub-atom within a ---- atom. When a program reads that file with a vulnerable tinytag parser, parsing can enter an infinite loop.
Which tinytag version fixes the issue?
The issue is fixed in tinytag 2.3.0. The fix reuses the primary atom-parsing path, which includes appropriate size checks.
Is there a mitigation if upgrading cannot be done immediately?
No workaround is available. Users must upgrade to tinytag 2.3.0.