CVE-2020-27823
HIGHCVSS 7.8/10EPSS 1.11%
Last modified
CVE-2020-27823 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. EPSS estimates a 1.11% chance of exploitation in the next 30 days.
Description
A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Uclouvain | Openjpeg | < 2.4.0 |
| Fedoraproject | Fedora | 32 |
| Fedoraproject | Fedora | 33 |
| Debian | Debian Linux | 9.0 |
| Debian | Debian Linux | 10.0 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1905762Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00011.htmlMailing List, Third Party Advisory
- https://www.debian.org/security/2021/dsa-4882Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1905762Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00011.htmlMailing List, Third Party Advisory
- https://www.debian.org/security/2021/dsa-4882Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-27823?
A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
How severe is CVE-2020-27823?
CVE-2020-27823 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 1.11% probability of exploitation in the next 30 days.
How do I fix CVE-2020-27823?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-27818A flaw was found in the check_chunk_name() function of pngch…3.3
- CVE-2020-27819An issue was discovered in libxls before and including 1.6.1…5.5
- CVE-2020-2782Vulnerability in the PeopleSoft Enterprise PeopleTools produ…7.1
- CVE-2020-27820A vulnerability was found in Linux kernel, where a use-after…4.7
- CVE-2020-27821A flaw was found in the memory management API of QEMU during…6
- CVE-2020-27822A flaw was found in Wildfly affecting versions 19.0.0.Final,…5.9
- CVE-2020-27824A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_e…5.5
- CVE-2020-27825A use-after-free flaw was found in kernel/trace/ring_buffer.…5.7
- CVE-2020-27826A flaw was found in Keycloak before version 12.0.0 where it …4.2
- CVE-2020-27827A flaw was found in multiple versions of OpenvSwitch. Specia…7.5
- CVE-2020-27828There's a flaw in jasper's jpc encoder in versions prior to …7.8
- CVE-2020-27829A heap based buffer overflow in coders/tiff.c may result in …5.5
Are you affected by CVE-2020-27823?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST