CVE-2021-22204

ExifTool Remote Code Execution Vulnerability

Exiftool

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

23. Apr 2021

Ausgewertete Quellen

• Debian
  https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html
• Debian
  https://www.debian.org/security/2021/dsa-4910
• Hinweis
  http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html
• Hinweis
  http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html
• Hinweis
  http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
• Hinweis
  http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html
• Hinweis
  http://www.openwall.com/lists/oss-security/2021/05/09/1
• Hinweis
  http://www.openwall.com/lists/oss-security/2021/05/10/5
• Hinweis
  https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json
• Hinweis
  https://hackerone.com/reports/1154542
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204
• CISA
  ExifTool Remote Code Execution Vulnerability
• NVD
  CVE-2021-22204