CVE-2023-42447
Published: 19 September 2023
Summary
CVE-2023-42447 is a high-severity Uncaught Exception (CWE-248) vulnerability in Whisperfish Blurhash-Rs. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 32.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2491
Vulnerability details
blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple…
more
panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates alerting on audit failures, directly providing the missing report of the error condition.
Reporting the security and privacy status to organizational officials ensures monitoring and assessment results are communicated rather than omitted.
Requires reporting and escalation of error conditions and incidents per documented procedures.
IR testing would expose missing error reporting that prevents timely incident detection and response.
Offers direct support for reporting incidents, addressing the failure to report error conditions or security events.
Includes explicit reporting of security status and analysis results, addressing missing reports of error or monitoring conditions.
Prevents abrupt termination from uncaught exceptions by requiring a defined, preserved-state failure mode.
Requires pre-defined safe responses for uncaught exceptions so they do not result in undefined or insecure program termination.