Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-42447: panic on parsing crafted blurhash inputs

blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.

CVE

Package

cargo blurhash (Rust)

Description

Impact

The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input.

In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include:

  • UTF-8 compliant strings containing multi-byte UTF-8 characters

Patches

The patches will be released under version 0.2.0, which requires user intervention because of slight API churn.

Workarounds

n.a.

References

n.a.

Related news

GHSA-cxvp-82cq-57h2: blurhash panics on parsing crafted inputs

### Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-8 characters ### Patches The patches will be released under version 0.2.0, which requires user intervention because of slight API churn. ### Workarounds n.a. ### References n.a.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda