CVE-2022-24613: Improper Handling of Exceptional Conditions

February 25, 2022 (updated March 8, 2022)

metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.

References

github.com/advisories/GHSA-p5pg-wm9q-8v6r
github.com/drewnoakes/metadata-extractor/issues/561
nvd.nist.gov/vuln/detail/CVE-2022-24613

Code Behaviors & Features

Detect and mitigate CVE-2022-24613 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →