CVE-2021-37622

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description The issue is related to an infinite loop in Exiv2 when modifying the metadata of a crafted image file, potentially allowing an attacker to cause a denial of service. This bug is triggered when deleting the IPTC data, which requires an extra command line option (-d I rm). The vulnerability can be exploited by tricking the victim into running Exiv2 on a specially crafted image file.

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the -d I rm command line option to delete IPTC data until the update is applied.