Vulnerability Description
blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Whisperfish | Blurhash-Rs | 0.1.1 |
Related Weaknesses (CWE)
References
- https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57Vendor Advisory
- https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57Vendor Advisory
FAQ
What is CVE-2023-42447?
CVE-2023-42447 is a vulnerability with a CVSS score of 8.6 (HIGH). blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, t...
How severe is CVE-2023-42447?
CVE-2023-42447 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-42447?
Check the references section above for vendor advisories and patch information. Affected products include: Whisperfish Blurhash-Rs.