CVE-2021-45943: 
Python vulnerability analysis and mitigation

CVE-2021-45943 affects GDAL (Geospatial Data Abstraction Library) versions 3.3.0 through 3.4.0. The vulnerability was discovered in December 2021 and involves a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile, which is called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment (NVD, OSS-Fuzz).

The vulnerability is a heap-based buffer overflow that occurs when processing PCIDSK binary segments. The issue was identified with a CVSS v3.1 Base Score of 5.5 (MEDIUM), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability was discovered through OSS-Fuzz testing and tracked as issue #41993 (NVD, OSS-Fuzz).

The vulnerability could result in denial of service via application crash or potentially lead to the execution of arbitrary code if a specially crafted file is processed with the PCIDSK driver (Debian Security, Gentoo Security).

The vulnerability was fixed in GDAL version 3.4.1. Various Linux distributions have released security updates to address this vulnerability, including Debian (versions 9, 10, and 11), Fedora (versions 34 and 35), and Gentoo. Users are strongly recommended to upgrade to patched versions (Debian LTS, Fedora, Gentoo Security).