GHSA-g4m4-9q4c-mfw6 Fiona affected by CVE-2020-14152 related to madler-zlib
A denial of service vulnerability in libjpeg, a transitive dependency of Fiona, may cause excessive memory consumption when processing malformed PROJ grid files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-g4m4-9q4c-mfw6?
GHSA-g4m4-9q4c-mfw6 is a denial of service vulnerability in fiona, published on 16 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Summary
Vulnerability scan of fiona shows CVE-2020-14152. The vulnerability is in libjpeg, a transitive dependency of fiona (via GDAL and PROJ).
Details
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
Impact
fiona will not open JPEG files and is not vulnerable to attack in that way. fiona might be vulnerable to malformed PROJ grid files using JPEG compression. No such vulnerability or compromise has been demonstrated.
Which versions are affected by GHSA-g4m4-9q4c-mfw6?
2 open source packages ship an affected version, including fiona.
| Package | Affected | Fixed in |
|---|---|---|
fiona PyPI | All versions | 1.10b2 |
fiona PyPI | All versions | 1.10b2 |
How do I fix GHSA-g4m4-9q4c-mfw6?
Upgrade fiona to 1.10b2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-g4m4-9q4c-mfw6 being exploited?
There is no known exploitation of GHSA-g4m4-9q4c-mfw6 in the wild and no public exploit code.