GMS-2023-3297: Bundled libwebp in pywebp vulnerable

October 6, 2023

Impact

pywebp versions before v0.3.0 bundled libwebp binaries in wheels that is vulnerable to CVE-2023-4863. The vulnerability was a heap buffer overflow which allowed a remote attacker to perform an out-of-bounds memory write.

Patches

The problem has been patched upstream in libwebp 1.3.2. pywebp was updated to bundle a patched version of libwebp in v0.3.0.

Workarounds

No known workarounds without upgrading.

References

github.com/advisories/GHSA-f9pm-4g9p-6vm3
github.com/anibali/pywebp/commit/1f938731a158a6584977cec2cce21b21c15f6c4b
github.com/anibali/pywebp/security/advisories/GHSA-f9pm-4g9p-6vm3

Code Behaviors & Features

Detect and mitigate GMS-2023-3297 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →