Veille CVE
CVE-2021-22204
7.8 Élevée Exploitée activementCatalogue CISA KEV — ExifTool Remote Code Execution Vulnerability
Ajoutée le 17/11/2021 · Échéance de correction (agences US) : 01/12/2021
Action requise : Apply updates per vendor instructions.
Description
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 6.8 Moyenne | cve@gitlab.com | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| 3.1 | 7.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | 6.8 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2021/05/09/1 Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/05/10/5 Mailing ListThird Party Advisory
- https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 Patch
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json Third Party Advisory
- https://hackerone.com/reports/1154542 ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ Release Notes
- https://www.debian.org/security/2021/dsa-4910 Mailing ListThird Party Advisory
- http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2021/05/09/1 Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/05/10/5 Mailing ListThird Party Advisory
- https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 Patch
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json Third Party Advisory
- https://hackerone.com/reports/1154542 ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ Release Notes
- https://www.debian.org/security/2021/dsa-4910 Mailing ListThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204 US Government Resource