Log in Start free

Vulnerability · Published Feb 28, 2023 · Assigned by Go

CVE-2022-41727Denial of service via crafted TIFF image in golang.org/x/image/tiff

Medium 5.5

In plain English

A medium-severity security flaw in golang.org/x/image/tiff from golang.org/x/image. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 76.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-golang-x-image0.5.0-1DEBIAN-CVE-2022-41727
Debian:13golang-golang-x-image0.5.0-1DEBIAN-CVE-2022-41727
Debian:14golang-golang-x-image0.5.0-1DEBIAN-CVE-2022-41727
Gogolang.org/x/image0.5.0GHSA-qgc7-mgm3-q253
Gogolang.org/x/image0.5.0GO-2023-1572
Ubuntu:22.04:LTSgolang-golang-x-imageno fix listedUBUNTU-CVE-2022-41727

Affected products (as reported)

VendorProductVersions
golang.org/x/image golang.org/x/image/tiff 0 – before 0.5.0

References