VulnerabilityModified

CVE-2020-27823

This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding.

HIGH 7.8EPSS 1.11%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 1.11% probability · 64th percentile
CISA KEV: Not listed
Weakness: CWE-20, CWE-120, CWE-787
Affected: uclouvain/openjpeg · fedoraproject/fedora · debian/debian linux
Source: secalert@redhat.com

References

https://bugzilla.redhat.com/show_bug.cgi?id=1905762Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00011.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/
https://www.debian.org/security/2021/dsa-4882Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1905762Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00011.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/
https://www.debian.org/security/2021/dsa-4882Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.