{
  "cisaActionDue": "2021-12-01",
  "cisaExploitAdd": "2021-11-17",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "ExifTool Remote Code Execution Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C18C58A-4D97-41AC-A2E6-5983D3376107",
              "versionEndExcluding": "12.24",
              "versionStartIncluding": "7.44",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image"
    },
    {
      "lang": "es",
      "value": "Una neutralizaci\u00f3n inapropiada de los datos del usuario en el formato de archivo DjVu en ExifTool versiones 7.44 y posteriores, permite una ejecuci\u00f3n de c\u00f3digo arbitrario cuando se analiza la imagen maliciosa"
    }
  ],
  "id": "CVE-2021-22204",
  "lastModified": "2025-03-13T16:41:27.050",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.7,
        "source": "cve@gitlab.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-04-23T18:15:08.127",
  "references": [
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2021/05/09/1"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2021/05/10/5"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/1154542"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/"
    },
    {
      "source": "cve@gitlab.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-4910"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2021/05/09/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2021/05/10/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/1154542"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-4910"
    }
  ],
  "sourceIdentifier": "cve@gitlab.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for perl-Image-ExifTool",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for perl-Image-ExifTool fixes the following issues:\n\nUpdate to version 12.25 fixes (boo#1185547 CVE-2021-22204)\n\n* JPEG XL support is now official\n* Added read support for Medical Research Council (MRC) image\n  files\n* Added ability to write a number of 3gp tags in video files\n* Added a new Sony PictureProfile value (thanks Jos Roost)\n* Added a new Sony LensType (thanks LibRaw)\n* Added a new Nikon LensID (thanks Niels Kristian Bech Jensen)\n* Added a new Canon LensType\n* Decode more GPS information from Blackvue dashcam videos\n* Decode a couple of new NikonSettings tags (thanks Warren\n  Hatch)\n* Decode a few new RIFF tags\n* Improved Validate option to add minor warning if standard\n  XMP is missing xpacket wrapper\n* Avoid decoding some large arrays in DNG images to improve\n  performance unless the -m option is used\n* Patched bug that could give runtime warning when trying to\n  write an empty XMP structure\n* Fixed decoding of ImageWidth/Height for JPEG XL images\n* Fixed problem were Microsoft Xtra tags couldn\u0027t be deleted\n\nversion 12.24:\n\n* Added a new PhaseOne RawFormat value (thanks LibRaw)\n* Decode a new Sony tag (thanks Jos Roost)\n* Decode a few new Panasonic and FujiFilm tags (thanks LibRaw\n  and Greybeard)\n* Patched security vulnerability in DjVu reader\n* Updated acdsee.config in distribution (thanks StarGeek)\n* Recognize AutoCAD DXF files\n* More work on experimental JUMBF read support\n* More work on experimental JPEG XL read/write support\n\nversion 12.23:\n\n* Added support for Olympus ORI files\n* Added experimental read/write support for JPEG XL images\n* Added experimental read support for JUMBF metadata in JPEG\n  and Jpeg2000 images\n* Added built-in support for parsing GPS track from Denver\n  ACG-8050 videos\n  with the -ee option\n* Added a some new Sony lenses (thanks Jos Roost and LibRaw)\n* Changed priority of Samsung trailer tags so the first\n  DepthMapImage takes\n  precedence when -a is not used\n* Improved identification of M4A audio files\n* Patched to avoid escaping \u0027,\u0027 in \u0027Binary data\u0027 message when\n  -struct is used\n* Removed Unknown flag from MXF VideoCodingSchemeID tag\n* Fixed -forcewrite=EXIF to apply to EXIF in binary header of\n  EPS files\n* API Changes:\n  + Added BlockExtract option\n\nversion 12.22:\n\n* Added a few new Sony LensTypes and a new SonyModelID (thanks\n  Jos Roost and LibRaw)\n* Added Extra BaseName tag\n* Added a new CanonModelID (thanks LibRaw)\n* Decode timed GPS from unlisted programs in M2TS videos with\n  the -ee3 option\n* Decode more Sony rtmd tags\n* Decode some tags for the Sony ILME-FX3 (thanks Jos Roost)\n* Allow negative values to be written to XMP-aux:LensID\n* Recognize HEVC video program in M2TS files\n* Enhanced -b option so --b suppresses tags with binary data\n* Improved flexibility when writing GPS coordinates:\n  + Now pulls latitude and longitude from a combined\n    GPSCoordinates string\n  + Recognizes the full word \u0027South\u0027 and \u0027West\u0027 to write\n    negative coordinates\n* Improved warning when trying to write an integer QuickTime\n  date/time tag and Time::Local is not available\n* Convert GPSSpeed from mph to km/h in timed GPS from Garmin\n  MP4 videos\n\nversion 12.21:\n\n* Added a few new iOS QuickTime tags\n* Decode a couple more Sony rtmd tags\n* Patch to avoid possible \u0027Use of uninitialized value\u0027 warning\n  when attempting to write QuickTime date/time tags with an\n  invalid value\n* Fixed problem writing Microsoft Xtra tags\n* Fixed Windows daylight savings time patch for file times\n  that was broken in 12.19 (however directory times will not\n  yet handle DST properly)\n\nversion 12.20:\n\n* Added ability to write some Microsoft Xtra tags in MOV/MP4\n  videos\n* Added two new Canon LensType values (thanks Norbert Wasser)\n* Added a new Nikon LensID\n* Fixed problem reading FITS comments that start before column\n  11\n\nversion 12.19:\n\n* Added -list_dir option\n* Added the \u0027ls-l\u0027 Shortcut tag\n* Extract Comment and History from FITS files\n* Enhanced FilePermissions to include device type (similar to\n  \u0027ls -l\u0027)\n* Changed the name of Apple ContentIdentifier tag to\n  MediaGroupUUID (thanks Neal Krawetz)\n* Fixed a potential \u0027substr outside of string\u0027 runtime error\n  when reading corrupted EXIF\n* Fixed edge case where NikonScanIFD may not be copied\n  properly when copying MakerNotes to another file\n* API Changes:\n  + Added ability to read/write System tags of directories\n  + Enhanced GetAllGroups() to support family 7 and take\n    optional ExifTool reference\n  + Changed QuickTimeHandler option default to 1\n\nversion 12.18:\n\n* Added a new SonyModelID\n* Decode a number of Sony tags for the ILCE-1 (thanks Jos\n  Roost)\n* Decode a couple of new Canon tags (thanks LibRaw)\n* Patched to read differently formatted UserData:Keywords as\n  written by iPhone\n* Patched to tolerate out-of-order Nikon MakerNote IFD entries\n  when obtaining tags necessary for decryption\n* Fixed a few possible Condition warnings for some\n  NikonSettings tags\n\nversion 12.17:\n\n* Added a new Canon FocusMode value\n* Added a new FujiFilm FilmMode value\n* Added a number of new XMP-crs tags (thanks Herb)\n* Decode a new H264 MDPM tag\n* Allow non-conforming lower-case XMP boolean \u0027true\u0027 and\n  \u0027false\u0027 values to be written, but only when print conversion\n  is disabled\n* Improved Validate option to warn about non-capitalized\n  boolean XMP values\n* Improved logic for setting GPSLatitude/LongitudeRef values\n  when writing\n* Changed -json and -php options so the -a option is implied\n  even without the -g option\n* Avoid extracting audio/video data from AVI videos when -ee\n  -u is used\n* Patched decoding of Canon ContinuousShootingSpeed for newer\n  firmware versions of the EOS-1DXmkIII\n* Re-worked LensID patch of version 12.00 (github issue #51)\n* Fixed a few typos in newly-added NikonSettings tags (thanks\n  Herb)\n* Fixed problem where group could not be specified for\n  PNG-pHYs tags when writing\nversion 12.16:\n* Extract another form of video subtitle text\n* Enhanced -ee option with -ee2 and -ee3 to allow parsing of\n  the H264 video stream in MP4 files\n* Changed a Nikon FlashMode value\n* Fixed problem that caused a failed DPX test on Strawberry\n  Perl\n* API Changes:\n  + Enhanced ExtractEmbedded option\n\nversion 12.15:\n\n* Added a couple of new Sony LensType values (thanks LibRaw\n  and Jos Roost)\n* Added a new Nikon FlashMode value (thanks Mike)\n* Decode NikonSettings (thanks Warren Hatch)\n* Decode thermal information from DJI RJPEG images\n* Fixed extra newline in -echo3 and -echo4 outputs added in\n  version 12.10\n* Fixed out-of-memory problem when writing some very large PNG\n  files under Windows\n\nversion 12.14:\n\n* Added support for 2 more types of timed GPS in video files\n  (that makes 49 different formats now supported)\n* Added validity check for PDF trailer dictionary Size\n* Added a new Pentax LensType\n* Extract metadata from Jpeg2000 Association box\n* Changed -g:XX:YY and -G:XX:YY options to show empty strings\n  for non-existent groups\n* Patched to issue warning and avoid writing date/time values\n  with a zero month or day number\n* Patched to avoid runtime warnings if trying to set FileName\n  to an empty string\n* Fixed issue that could cause GPS test number 12 to fail on\n  some systems\n* Fixed problem extracting XML as a block from Jpeg2000\n  images, and extract XML tags in the XML group instead of XMP\n- Update URL\n\nupdate to 12.13:\n\n* Add time zone automatically to most string-based QuickTime date/time tags\n  when writing unless the PrintConv option is disabled\n* Added -i HIDDEN option to ignore files with names that start with \u0027.\u0027\n* Added a few new Nikon ShutterMode values (thanks Jan Skoda)\n* Added ability to write Google GCamera MicroVideo XMP tags\n* Decode a new Sony tag (thanks LibRaw)\n* Changed behaviour when writing only pseudo tags to return an error and avoid\n  writing any other tags if writing FileName fails\n* Print \u0027X image files read\u0027 message even if only 1 file is read when at least\n  one other file has failed the -if condition\n* Added ability to geotag from DJI CSV log files\n* Added a new CanonModelID\n* Added a couple of new Sony LensType values (thanks LibRaw)\n* Enhanced -csvDelim option to allow \u0027\\t\u0027, \u0027\\n\u0027, \u0027\\r\u0027 and \u0027\\\\\u0027\n* Unescape \u0027\\b\u0027 and \u0027\\f\u0027 in imported JSON values\n* Fixed bug introduced in 12.10 which generated a \u0027Not an integer\u0027 warning\n  when attempting to shift some QuickTime date/time tags\n* Fixed shared-write permission problem with -@ argfile when using -stay_open\n  and a filename containing special characters on Windows\n* Added -csvDelim option\n* Added new Canon and Olympus LensType values (thanks LibRaw)\n* Added a warning if ICC_Profile is deleted from an image (github issue #63)\n* EndDir() function for -if option now works when -fileOrder is used\n* Changed FileSize conversion to use binary prefixes since that is how the\n  conversion is currently done (eg. MiB instead of MB)\n* Patched -csv option so columns aren\u0027t resorted when using -G option and one\n  of the tags is missing from a file\n* Fixed incompatiblity with Google Photos when writing UserData:GPSCoordinates\n  to MP4 videos\n* Fixed problem where the tags available in a -p format string were limited to\n  the same as the -if[NUM] option when NUM was specified\n* Fixed incorrect decoding of SourceFileIndex/SourceDirectoryIndex for Ricoh\n  models\n\nUpdate to 12.10\n\n* Added -validate test for proper TIFF magic number in\n  JPEG EXIF header\n* Added support for Nikon Z7 LensData version 0801\n* Added a new XMP-GPano tag\n* Decode ColorData for the Canon EOS 1DXmkIII\n* Decode more tags for the Sony ILCE-7SM3\n* Automatically apply QuickTimeUTC option for CR3 files\n* Improved decoding of XAttrMDLabel from MacOS files\n* Ignore time zones when writing date/time values and\n  using the -d option\n* Enhanced -echo3 and -echo4 options to allow exit status\n  to be returned\n* Changed -execute so the -q option no longer suppresses\n  the \u0027{ready}\u0027 message when a synchronization number is used\n* Added ability to copy CanonMakerNotes from CR3 images\n  to other file types\n* Added read support for ON1 presets file (.ONP)\n* Added two new CanonModelID values\n* Added trailing \u0027/\u0027 when writing QuickTime:GPSCoordinates\n* Added a number of new XMP-crs tags\n* Added a new Sony LensType (thanks Jos Roost)\n* Added a new Nikon Z lens (thanks LibRaw)\n* Added a new Canon LensType\n* Decode ColorData for Canon EOS R5/R6\n* Decode a couple of new HEIF tags\n* Decode FirmwareVersion for Canon M50\n* Improved decoding of Sony CreativeStyle tags\n* Improved parsing of Radiance files to recognize comments\n* Renamed GIF AspectRatio tag to PixelAspectRatio\n* Patched EndDir() feature so subdirectories are always\n  processed when -r is used (previously, EndDir() would\n  end processing of a directory completely)\n* Avoid loading GoPro module unnecessarily when reading MP4 videos\n  from some other cameras\n* Fixed problem with an incorrect naming of CodecID tags in some\n  MKV videos\n* Fixed verbose output to avoid \u0027adding\u0027 messages for\n  existing flattened XMP tags\n* Added a new Sony LensType\n* Recognize Mac OS X xattr files\n* Extract ThumbnailImage from MP4 videos of more dashcam models\n* Improved decoding of a number of Sony tags\n* Fixed problem where the special -if EndDir() function didn\u0027t\n  work properly for directories after the one in which\n  it was initially called\n* Patched to read DLL files which don\u0027t have a .rsrc section\n* Patched to support new IGC date format when geotagging\n* Patched to read DLL files with an invalid size in the header \n* Added support for GoPro .360 videos\n* Added some new Canon RF and Nikkor Z lenses\n* Added some new Sony LensType and CreativeStyle values\n  and decode some ILCE-7C tags\n* Added a number of new Olympus SceneMode values\n* Added a new Nikon LensID\n* Decode more timed metadata from Insta360 videos\n* Decode timed GPS from videos of more Garmin dashcam models\n* Decode a new GoPro video tag\n* Reformat time-only EventTime values when writing and prevent\n  arbitrary strings from being written\n* Patched to accept backslashes in SourceFile entries for -csv option\n\nupdate to 12.06\n\n* Added read support for Lyrics3 metadata (and fixed problem\n  where APE metadata may be ignored if Lyrics3 exists)\n* Added a new Panasonic VideoBurstMode value\n* Added a new Olympus MultipleExposureMode value\n* Added a new Nikon LensID\n* Added back conversions for XMP-dwc EventTime that were removed\n  in 12.04 with a patch to allow time-only values\n* Decode GIF AspectRatio\n* Decode Olympus FocusBracketStepSize\n* Extract PNG iDOT chunk in Binary format with the\n  name AppleDataOffsets\n* Process PNG images which do not start with mandatory\n  IHDR chunk\n* Added a new Panasonic SelfTimer value\n* Decode a few more DPX tags\n* Extract AIFF APPL tag as ApplicationData\n* Fixed bug writing QuickTime ItemList \u0027gnre\u0027 Genre values\n* Fixed an incorrect value for Panasonic VideoBurstResolution\n* Fixed problem when applying a time shift to some invalid\n  makernote date/time values\n\nupdate to 12.04:\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Change \n\nupdate to 11.50, see Image-ExifTool-11.50.tar.gz for details\n\nUpdate to version 11.30:\n\n* Add a new Sony/Minolta LensType.\n* Decode streaming metadata from TomTom Bandit Action Cam MP4\n  videos.\n* Decode Reconyx HF2 PRO maker notes.\n* Decode ColorData for some new Canon models.\n* Enhanced -geotag feature to set AmbientTemperature if\n  available.\n* Remove non-significant spaces from some DICOM values.\n* Fix possible \u0027\u0027x\u0027 outside of string\u0027 error when reading\n  corrupted EXIF.\n* Fix incorrect write group for GeoTIFF tags.\n\nUpdate to version 11.29\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Changes\n\nUpdate to version 11.27\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Changes\n\nUpdate to version 11.24\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Changes\n\nUpdate to version 11.11 (changes since 11.01):\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Changes\n\nUpdate to 11.01:\n\n* Added a new ProfileCMMType\n* Added a Validate warning about non-standard EXIF or XMP in\n  PNG images\n* Added a new Canon LensType\n* Decode a couple more PanasonicRaw tags\n* Patched to avoid adding tags to QuickTime videos with multiple\n  \u0027mdat\u0027 atoms --\u003e avoids potential corruption of these videos!\n\nUpdate to 11.00:\n\n* Added read support for WTV and DVR-MS videos\n* Added print conversions for some ASF date/time tags\n* Added a new SonyModelID\n* Decode a new PanasonicRaw tag\n* Decode some new Sony RX100 VI tags\n* Made Padding and OffsetSchema tags \u0027unsafe\u0027 so they\n  aren\u0027t copied by default \n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-707",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0707-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0707-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SLQ4XG6SNL6OL7SHPBZLVWYCAEZGZW5X/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0707-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SLQ4XG6SNL6OL7SHPBZLVWYCAEZGZW5X/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1185547",
        "url": "https://bugzilla.suse.com/1185547"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-22204 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-22204/"
      }
    ],
    "title": "Security update for perl-Image-ExifTool",
    "tracking": {
      "current_release_date": "2021-05-10T18:41:24Z",
      "generator": {
        "date": "2021-05-10T18:41:24Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0707-1",
      "initial_release_date": "2021-05-10T18:41:24Z",
      "revision_history": [
        {
          "date": "2021-05-10T18:41:24Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "exiftool-12.25-bp152.4.3.1.noarch",
                "product": {
                  "name": "exiftool-12.25-bp152.4.3.1.noarch",
                  "product_id": "exiftool-12.25-bp152.4.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
                "product": {
                  "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
                  "product_id": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
                "product": {
                  "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
                  "product_id": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP1",
                "product": {
                  "name": "SUSE Package Hub 15 SP1",
                  "product_id": "SUSE Package Hub 15 SP1"
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP2",
                "product": {
                  "name": "SUSE Package Hub 15 SP2",
                  "product_id": "SUSE Package Hub 15 SP2"
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exiftool-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:exiftool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "exiftool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exiftool-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:exiftool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "exiftool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exiftool-12.25-bp152.4.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:exiftool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "exiftool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-22204",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-22204"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:exiftool-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP1:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP1:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP2:exiftool-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
          "openSUSE Leap 15.2:exiftool-12.25-bp152.4.3.1.noarch",
          "openSUSE Leap 15.2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
          "openSUSE Leap 15.2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-22204",
          "url": "https://www.suse.com/security/cve/CVE-2021-22204"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185547 for CVE-2021-22204",
          "url": "https://bugzilla.suse.com/1185547"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:exiftool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP1:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP1:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:exiftool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:exiftool-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP1:exiftool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP1:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP1:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:exiftool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:exiftool-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-10T18:41:24Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-22204"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22204"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-23T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image",
  "id": "GHSA-9377-7hwr-p4w6",
  "modified": "2024-07-24T18:31:14Z",
  "published": "2022-05-24T17:48:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22204"
    },
    {
      "type": "WEB",
      "url": "https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1154542"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2021/dsa-4910"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/05/09/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/05/10/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2021-22204",
    "description": "Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image",
    "id": "GSD-2021-22204",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-22204.html",
      "https://www.debian.org/security/2021/dsa-4910",
      "https://ubuntu.com/security/CVE-2021-22204",
      "https://advisories.mageia.org/CVE-2021-22204.html",
      "https://security.archlinux.org/CVE-2021-22204",
      "https://packetstormsecurity.com/files/cve/CVE-2021-22204"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-22204"
      ],
      "details": "Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image",
      "id": "GSD-2021-22204",
      "modified": "2023-12-13T01:23:24.115825Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cisa.gov": {
      "cveID": "CVE-2021-22204",
      "dateAdded": "2021-11-17",
      "dueDate": "2021-12-01",
      "product": "Exiftool",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image",
      "vendorProject": "Perl",
      "vulnerabilityName": "ExifTool Remote Code Execution Vulnerability"
    },
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@gitlab.com",
        "ID": "CVE-2021-22204",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ExifTool",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e=7.44, \u003c12.24"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "ExifTool"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "Thanks vakzz for reporting this vulnerability through the GitLab HackerOne bug bounty program who then reported it to the ExifTool maintainer"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image"
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Improper neutralization of directives in dynamically evaluated code (\u0027eval injection\u0027) in ExifTool"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800",
            "refsource": "MISC",
            "url": "https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800"
          },
          {
            "name": "https://hackerone.com/reports/1154542",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/1154542"
          },
          {
            "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json",
            "refsource": "CONFIRM",
            "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json"
          },
          {
            "name": "DSA-4910",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2021/dsa-4910"
          },
          {
            "name": "FEDORA-2021-de850ed71e",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/"
          },
          {
            "name": "FEDORA-2021-e3d8833d36",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/"
          },
          {
            "name": "FEDORA-2021-88d24aa32b",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/"
          },
          {
            "name": "[oss-security] 20210509 [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2021/05/09/1"
          },
          {
            "name": "[oss-security] 20210510 Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2021/05/10/5"
          },
          {
            "name": "http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html"
          },
          {
            "name": "[debian-lts-announce] 20210516 [SECURITY] [DLA 2663-1] libimage-exiftool-perl security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html"
          },
          {
            "name": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html"
          },
          {
            "name": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html"
          },
          {
            "name": "http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "12.24",
                "versionStartIncluding": "7.44",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@gitlab.com",
          "ID": "CVE-2021-22204"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-74"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800"
            },
            {
              "name": "https://hackerone.com/reports/1154542",
              "refsource": "MISC",
              "tags": [
                "Permissions Required",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/1154542"
            },
            {
              "name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json"
            },
            {
              "name": "DSA-4910",
              "refsource": "DEBIAN",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.debian.org/security/2021/dsa-4910"
            },
            {
              "name": "FEDORA-2021-e3d8833d36",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/"
            },
            {
              "name": "FEDORA-2021-de850ed71e",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/"
            },
            {
              "name": "FEDORA-2021-88d24aa32b",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/"
            },
            {
              "name": "[oss-security] 20210509 [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2021/05/09/1"
            },
            {
              "name": "[oss-security] 20210510 Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2021/05/10/5"
            },
            {
              "name": "http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html"
            },
            {
              "name": "[debian-lts-announce] 20210516 [SECURITY] [DLA 2663-1] libimage-exiftool-perl security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-07-27T16:29Z",
      "publishedDate": "2021-04-23T18:15Z"
    }
  }
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-22204",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-22204"
    }
  },
  "description": "exiftool\u662f\u4e00\u4e2a\u5e94\u7528\u8f6f\u4ef6\u3002\u4f7f\u5143\u6570\u636e\u66f4\u6613\u4e8e\u8bbf\u95ee\u3002\n\nExifTool versions 7.44\u7248\u672c\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u89e3\u6790\u6076\u610f\u56fe\u50cf\u65f6\u4efb\u610f\u6267\u884c\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-39938",
  "openTime": "2021-05-31",
  "patchDescription": "exiftool\u662f\u4e00\u4e2a\u5e94\u7528\u8f6f\u4ef6\u3002\u4f7f\u5143\u6570\u636e\u66f4\u6613\u4e8e\u8bbf\u95ee\u3002\r\n\r\nExifTool versions 7.44\u7248\u672c\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u89e3\u6790\u6076\u610f\u56fe\u50cf\u65f6\u4efb\u610f\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "exiftool\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "exiftool exiftool \u003c=7.44"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-22204",
  "serverity": "\u4e2d",
  "submitTime": "2021-04-25",
  "title": "exiftool\u6ce8\u5165\u6f0f\u6d1e"
}