Go/golang.org/x/image CVE-2023-29408: medium 6.5, EPSS 0.93%
Golang TIFF decoder does not place a limit on the size of compressed tile data
Action: Upgrade golang.org/x/image to 0.10.0 or later.
go get golang.org/x/image@v0.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.10.0 | - |
Fixed versions
| 0.10.0 |
Sources
- osv: GHSA-x92r-3vfx-4cv3
- https://nvd.nist.gov/vuln/detail/CVE-2023-29408
- https://go.dev/cl/514897
- https://go.dev/issue/61582
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK
- https://pkg.go.dev/vuln/GO-2023-1989
- https://security.netapp.com/advisory/ntap-20230831-0009
CVE-2023-29408 · published · modified · JSON