csaf_opensuse - opensuse-su-2025:14982-1

opensuse-su-2025:14982-1

Vulnerability from csaf_opensuse

Published

2025-04-10 00:00

Modified

2025-04-10 00:00

Summary

govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media

Notes

Title of the patch

govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media

Description of the patch

These are all security issues fixed in the govulncheck-vulndb-0.0.20250409T170536-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2025-14982

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20250409T170536-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-14982",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14982-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-31483 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-31483/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-31489 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-31489/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-32024 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-32024/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-32025 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-32025/"
      }
    ],
    "title": "govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-04-10T00:00:00Z",
      "generator": {
        "date": "2025-04-10T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:14982-1",
      "initial_release_date": "2025-04-10T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-04-10T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
                  "product_id": "govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
                  "product_id": "govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
                  "product_id": "govulncheck-vulndb-0.0.20250409T170536-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64",
                  "product_id": "govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-31483",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-31483"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src \u0027self\u0027 to default-src \u0027none\u0027; form-action \u0027none\u0027; sandbox;. This vulnerability is fixed in 2.2.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-31483",
          "url": "https://www.suse.com/security/cve/CVE-2025-31483"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-31483"
    },
    {
      "cve": "CVE-2025-31489",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-31489"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-31489",
          "url": "https://www.suse.com/security/cve/CVE-2025-31489"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-10T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-31489"
    },
    {
      "cve": "CVE-2025-32024",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-32024"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn\u0027t trust the input images, this could be abused to construct denial-of-service attacks. v0.10.0 added LimitNumTags (default 5000) and LimitTagSize (default 10000) options.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-32024",
          "url": "https://www.suse.com/security/cve/CVE-2025-32024"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1240992 for CVE-2025-32024",
          "url": "https://bugzilla.suse.com/1240992"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-32024"
    },
    {
      "cve": "CVE-2025-32025",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-32025"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn\u0027t trust the input images, this could be abused to construct denial-of-service attacks. v0.11.0 added a 10 MB upper limit.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-32025",
          "url": "https://www.suse.com/security/cve/CVE-2025-32025"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1240993 for CVE-2025-32025",
          "url": "https://bugzilla.suse.com/1240993"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-32025"
    }
  ]
}

CVE-2025-31483 (GCVE-0-2025-31483)

Vulnerability from cvelistv5

Published

2025-04-03 18:07

Modified

2025-04-03 18:49

Severity ?

4.8 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.

References

►

URL

Tags

	https://github.com/miniflux/v2/security/advisories/GHSA-cq88-842x-2jhp	x_refsource_CONFIRM
	https://github.com/miniflux/v2/commit/cb695e653a08af4cabcb277c271ce74bd0c746e6	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	miniflux	v2	Version: < 2.2.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31483",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T18:49:23.775945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T18:49:45.617Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "v2",
          "vendor": "miniflux",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src \u0027self\u0027 to default-src \u0027none\u0027; form-action \u0027none\u0027; sandbox;. This vulnerability is fixed in 2.2.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-03T18:07:32.241Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/miniflux/v2/security/advisories/GHSA-cq88-842x-2jhp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/miniflux/v2/security/advisories/GHSA-cq88-842x-2jhp"
        },
        {
          "name": "https://github.com/miniflux/v2/commit/cb695e653a08af4cabcb277c271ce74bd0c746e6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/miniflux/v2/commit/cb695e653a08af4cabcb277c271ce74bd0c746e6"
        }
      ],
      "source": {
        "advisory": "GHSA-cq88-842x-2jhp",
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-31483",
    "datePublished": "2025-04-03T18:07:32.241Z",
    "dateReserved": "2025-03-28T13:36:51.297Z",
    "dateUpdated": "2025-04-03T18:49:45.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-32024 (GCVE-0-2025-32024)

Vulnerability from cvelistv5

Published

2025-04-08 15:10

Modified

2025-04-08 15:39

Severity ?

6.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. v0.10.0 added LimitNumTags (default 5000) and LimitTagSize (default 10000) options.

References

►

URL

Tags

	https://github.com/bep/imagemeta/security/advisories/GHSA-q7rw-w4cq-2j6w	x_refsource_CONFIRM
	https://github.com/bep/imagemeta/commit/4fd89616d8bf7f9bb892360d3fb19080ec2b4602	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	bep	imagemeta	Version: < 0.10.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32024",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T15:38:59.116479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T15:39:08.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "imagemeta",
          "vendor": "bep",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn\u0027t trust the input images, this could be abused to construct denial-of-service attacks. v0.10.0 added LimitNumTags (default 5000) and LimitTagSize (default 10000) options."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T15:10:42.867Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bep/imagemeta/security/advisories/GHSA-q7rw-w4cq-2j6w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bep/imagemeta/security/advisories/GHSA-q7rw-w4cq-2j6w"
        },
        {
          "name": "https://github.com/bep/imagemeta/commit/4fd89616d8bf7f9bb892360d3fb19080ec2b4602",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bep/imagemeta/commit/4fd89616d8bf7f9bb892360d3fb19080ec2b4602"
        }
      ],
      "source": {
        "advisory": "GHSA-q7rw-w4cq-2j6w",
        "discovery": "UNKNOWN"
      },
      "title": "bep/imagemeta allows excessively large EXIF data structures"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32024",
    "datePublished": "2025-04-08T15:10:42.867Z",
    "dateReserved": "2025-04-01T21:57:32.955Z",
    "dateUpdated": "2025-04-08T15:39:08.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-32025 (GCVE-0-2025-32025)

Vulnerability from cvelistv5

Published

2025-04-08 15:13

Modified

2025-04-08 15:37

Severity ?

6.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. v0.11.0 added a 10 MB upper limit.

References

►

URL

Tags

	https://github.com/bep/imagemeta/security/advisories/GHSA-fmhh-rw3h-785m	x_refsource_CONFIRM
	https://github.com/bep/imagemeta/commit/ee0de9b029f4e82106729f69559f27c9a404229d	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	bep	imagemeta	Version: < v0.11.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32025",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T15:37:48.564851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T15:37:58.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "imagemeta",
          "vendor": "bep",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c v0.11.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn\u0027t trust the input images, this could be abused to construct denial-of-service attacks. v0.11.0 added a 10 MB upper limit."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T15:13:24.770Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bep/imagemeta/security/advisories/GHSA-fmhh-rw3h-785m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bep/imagemeta/security/advisories/GHSA-fmhh-rw3h-785m"
        },
        {
          "name": "https://github.com/bep/imagemeta/commit/ee0de9b029f4e82106729f69559f27c9a404229d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bep/imagemeta/commit/ee0de9b029f4e82106729f69559f27c9a404229d"
        }
      ],
      "source": {
        "advisory": "GHSA-fmhh-rw3h-785m",
        "discovery": "UNKNOWN"
      },
      "title": "bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32025",
    "datePublished": "2025-04-08T15:13:24.770Z",
    "dateReserved": "2025-04-01T21:57:32.955Z",
    "dateUpdated": "2025-04-08T15:37:58.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-31489 (GCVE-0-2025-31489)

Vulnerability from cvelistv5

Published

2025-04-03 19:36

Modified

2025-04-03 20:36

Severity ?

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Summary

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.

References

►

URL

Tags

	https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh	x_refsource_CONFIRM
	https://github.com/minio/minio/pull/21103	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	minio	minio	Version: < RELEASE.2025-04-03T14-56-28Z

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31489",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T20:36:06.237877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T20:36:19.079Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "minio",
          "vendor": "minio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c RELEASE.2025-04-03T14-56-28Z"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-03T19:36:09.335Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh"
        },
        {
          "name": "https://github.com/minio/minio/pull/21103",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/minio/minio/pull/21103"
        }
      ],
      "source": {
        "advisory": "GHSA-wg47-6jq2-q2hh",
        "discovery": "UNKNOWN"
      },
      "title": "MinIO performs incomplete signature validation for unsigned-trailer uploads"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-31489",
    "datePublished": "2025-04-03T19:36:09.335Z",
    "dateReserved": "2025-03-28T13:36:51.298Z",
    "dateUpdated": "2025-04-03T20:36:19.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

opensuse-su-2025:14982-1

Vulnerability from csaf_opensuse

CVE-2025-31483 (GCVE-0-2025-31483)

Vulnerability from cvelistv5

CVE-2025-32024 (GCVE-0-2025-32024)

Vulnerability from cvelistv5

CVE-2025-32025 (GCVE-0-2025-32025)

Vulnerability from cvelistv5

CVE-2025-31489 (GCVE-0-2025-31489)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature