CVE-2021-22204

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2021/05/09/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/5 Mailing List Third Party Advisory
https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 Patch
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json Third Party Advisory
https://hackerone.com/reports/1154542 Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ Release Notes
https://www.debian.org/security/2021/dsa-4910 Mailing List Third Party Advisory
http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2021/05/09/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/10/5 Mailing List Third Party Advisory
https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 Patch
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json Third Party Advisory
https://hackerone.com/reports/1154542 Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ Release Notes
https://www.debian.org/security/2021/dsa-4910 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
History

21 Nov 2024, 05:49

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References () http://www.openwall.com/lists/oss-security/2021/05/09/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2021/05/09/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2021/05/10/5 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2021/05/10/5 - Mailing List, Third Party Advisory
References () https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 - Patch () https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 - Patch
References () https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json - Third Party Advisory () https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json - Third Party Advisory
References () https://hackerone.com/reports/1154542 - Exploit, Issue Tracking, Third Party Advisory () https://hackerone.com/reports/1154542 - Exploit, Issue Tracking, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ - Release Notes () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ - Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ - Release Notes () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ - Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ - Release Notes () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ - Release Notes
References () https://www.debian.org/security/2021/dsa-4910 - Mailing List, Third Party Advisory () https://www.debian.org/security/2021/dsa-4910 - Mailing List, Third Party Advisory
CVSS v2 : 6.8
v3 : 7.8 		v2 : 6.8
v3 : 6.8

24 Jul 2024, 17:07

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html - Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 - Patch, Third Party Advisory () https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 - Patch
References () https://hackerone.com/reports/1154542 - Permissions Required, Third Party Advisory () https://hackerone.com/reports/1154542 - Exploit, Issue Tracking, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ - Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ - Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ - Release Notes
References () https://www.debian.org/security/2021/dsa-4910 - Third Party Advisory () https://www.debian.org/security/2021/dsa-4910 - Mailing List, Third Party Advisory

07 Nov 2023, 03:30

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/', 'name': 'FEDORA-2021-de850ed71e', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/', 'name': 'FEDORA-2021-88d24aa32b', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/', 'name': 'FEDORA-2021-e3d8833d36', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ -

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-74 CWE-94
Information

Published : 2021-04-23 18:15

Updated : 2025-03-13 16:41

NVD link : CVE-2021-22204

Mitre link : CVE-2021-22204

CVE.ORG link : CVE-2021-22204

JSON object : View

Products Affected

debian

  • debian_linux

fedoraproject

  • fedora

exiftool_project

  • exiftool
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')