CVE-2023-42447

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Uncaught Exception pada whisperfish blurhash-rs. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.

Rincian

Terbit di NVD

19 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-248: Uncaught Exception
CWE-392: Missing Report of Error Condition
CWE-1284: Improper Validation of Specified Quantity in Input

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57h2 advisory vendor