CVE-2021-22204 vulnerability in Exiftoolproject and Other Products
Published on April 23, 2021
Known Exploited Vulnerability
This ExifTool Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image.
The following remediation steps are recommended / required by December 1, 2021: Apply updates per vendor instructions.
Vulnerability Analysis
CVE-2021-22204 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2021-22204 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2021-22204
You can be notified by stack.watch whenever vulnerabilities like CVE-2021-22204 are published in these products:
What versions are vulnerable to CVE-2021-22204?
-
Exiftoolproject Exiftool
Version 7.44
Fixed in Version 12.24
-
Debian Linux
Version 9.0
-
Debian Linux
Version 10.0
-
Fedora Project Fedora
Version 32
-
Fedora Project Fedora
Version 33
-
Fedora Project Fedora
Version 34
Vulnerable Packages
The following package name and versions may be associated with CVE-2021-22204
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| npm | exiftool-vendored | < 14.3.0 | 14.3.0 |