GHSA-rcr2-hggw-43wm: Buffer Overflow
Impact Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service.
Patches The bug has been patched in version 0.0.19
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/surfioto a version that resolves this vulnerability.Fixed in 0.0.19 - Upgrade
Upgrade
surfioto a version that resolves this vulnerability.Fixed in 0.0.19
Event History
Frequently Asked Questions
Which deployments are most exposed?
The highest-risk deployments are services that use surfio to parse untrusted IRAP files received over a network, such as a web service. In that scenario, exploitation does not require authentication or user interaction according to the supplied severity vector.
What versions should be remediated?
Affected versions are those earlier than 0.0.19. Version 0.0.19 contains the patch.
What can be done if updating is not immediately possible?
The issue is triggered when surfio parses an IRAP file with size fields that are not correctly validated. Affected deployments should avoid processing untrusted IRAP files until they can update.