CVE-2019-20421
exiv2: infinite loop and hang in Jp2Image::readMetadata() in jp2image.cpp could lead to DoS
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 30, 2019
Updated · June 27, 2026
Description
A denial of service vulnerability was found in exiv2 in the way JPEG 2000 (JP2) metadata was read when processing an image file. A remote attacker could abuse this flaw to create a specially crafted image, causing exiv2 to enter into an infinite loop when processing an incoming malicious image.
Statement
This flaw did not affect the versions of exiv2 as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include the vulnerable code, which was introduced in a later version of the library.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')