CVE-2023-29408: 
NixOS vulnerability analysis and mitigation

CVE-2023-29408 is a vulnerability in the TIFF decoder of Golang's image package that was discovered and disclosed in July 2023. The vulnerability exists because the decoder does not place a limit on the size of compressed tile data, allowing a maliciously-crafted image to cause excessive resource consumption (NVD, Go Issue).

The vulnerability allows a maliciously-crafted image, despite having small pixel dimensions and encoded size, to force the decoder to process large amounts of compressed data. This vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating it requires user interaction but can be exploited remotely without authentication (NVD, NetApp Advisory).

Successful exploitation of this vulnerability can lead to Denial of Service (DoS) by consuming excessive memory and CPU resources during the decoding process of maliciously crafted TIFF images (NetApp Advisory).

The vulnerability has been fixed in golang.org/x/image version 0.10.0 and later. Users are advised to upgrade to the patched version. The fix was implemented through a patch that addresses the unlimited compressed tile data issue (Go Vuln).

Multiple Linux distributions including Fedora have released security updates to address this vulnerability in their packages. Fedora versions 37, 38, and 39 have been updated with patches (Fedora Update).