Perl · Exiftool
CVE-2021-22204
ExifTool Remote Code Execution Vulnerability
공격에 악용됨
보통 6.8 공격 가능성: >99.9%
무엇인가
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
CISA: Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2021년 12월 1일
- CISA 목록에 추가됨
- 2021년 11월 17일
- 게시됨
- 2021년 4월 23일
- 심각도
- 보통 6.8 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- >99.9% 알려진 모든 취약점 중 상위 0.1%
- 약점 유형
- CWE-95
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(14)
- https://www.debian.org/security/2021/dsa-4910
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQ…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHA…
- https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6…
- https://hackerone.com/reports/1154542
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json
- http://www.openwall.com/lists/oss-security/2021/05/09/1
- http://www.openwall.com/lists/oss-security/2021/05/10/5
- http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.