CVE-2023-29407
2 advisories.
Go/golang.org/x/image CVE-2023-29407: medium 6.5, EPSS 0.87%
Golang TIFF decoder vulnerable to excessive CPU consumption
Action: Upgrade golang.org/x/image to 0.10.0 or later.
go get golang.org/x/image@v0.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.10.0 | - |
Fixed versions
| 0.10.0 |
Sources
- osv: GHSA-j3p8-6mrq-6g7h
- https://nvd.nist.gov/vuln/detail/CVE-2023-29407
- https://go.dev/cl/514897
- https://go.dev/issue/61581
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK
- https://pkg.go.dev/vuln/GO-2023-1990
- https://security.netapp.com/advisory/ntap-20230831-0009
CVE-2023-29407 · published · modified · JSON
Go/golang.org/x/image CVE-2023-29407: unknown, EPSS 0.87%
Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
Action: Upgrade golang.org/x/image to 0.10.0 or later.
go get golang.org/x/image@v0.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.10.0 | - |
Fixed versions
| 0.10.0 |
Sources
CVE-2023-29407 · published · modified · JSON