CVE-2021-37623

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description The issue is related to an infinite loop in the Exiv2 library, which can be triggered when modifying the metadata of a crafted image file. This can potentially allow an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is specifically triggered when deleting the IPTC data, which requires an extra command line option (-d I rm).

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the -d I rm command line option to minimize the risk of exploitation. Restrict access to the Exiv2 operation that requires this option to reduce the likelihood of an attacker triggering the infinite loop.