CVE-2023-39327: 
NixOS vulnerability analysis and mitigation

A vulnerability (CVE-2023-39327) was discovered in OpenJPEG that allows maliciously constructed pictures to cause the program to enter a large loop and continuously print warning messages on the terminal. The vulnerability was disclosed on July 12, 2024, and affects various versions of OpenJPEG software (Red Hat CVE, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. It is classified as CWE-400 (Uncontrolled Resource Consumption), which can lead to Denial of Service through resource exhaustion (Red Hat CVE).

The primary impact of this vulnerability is a potential Denial of Service condition through resource consumption. When exploited, the vulnerability can cause the program to enter an extensive loop state, resulting in continuous warning message output to the terminal, which could affect system availability (Red Hat CVE).

The vulnerability requires user interaction and can be triggered by specially crafted image files. The attack vector is network-accessible, with low attack complexity and no privileges required (Red Hat CVE).

Several fixes have been released for different versions of OpenJPEG2. Ubuntu has released fixes in versions 2.5.0-2ubuntu1 for 24.10, 2.5.0-2ubuntu0.1 for 24.04 LTS, 2.4.0-6ubuntu0.1 for 22.04 LTS, and 2.3.1-1ubuntu4.20.04.2 for 20.04 LTS. The vulnerability has also been addressed in version 2.5.3 (Ubuntu Security).