GHSA-v8gq-5grq-9728

Suggest an improvement
Source
https://github.com/advisories/GHSA-v8gq-5grq-9728
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-v8gq-5grq-9728/GHSA-v8gq-5grq-9728.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v8gq-5grq-9728
Aliases
Published
2022-09-16T21:03:43Z
Modified
2023-11-08T04:23:09Z
Summary
mozjpeg DecompressScanlines::read_scanlines is Unsound
Details

This issue and vector is similar to RUSTSEC-2020-0029 of rgb crate which mozjpeg depends on.

Affected versions of mozjpeg crate allow creating instances of any type T from bytes, and do not correctly constrain T to the types for which it is safe to do so.

Examples of safety violation possible for a type T:

  • T contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.
  • T requires a safety and/or validity invariant for its construction that may be violated.

The issue was fixed in 0.8.19 by using safer types and involving rgb dependency bump.

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-09-16T21:03:43Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

crates.io / mozjpeg

Package

Name
mozjpeg
View open source insights on deps.dev
Purl
pkg:cargo/mozjpeg

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.19

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-v8gq-5grq-9728/GHSA-v8gq-5grq-9728.json"