CVE-2024-24792: 
Wolfi vulnerability analysis and mitigation

A vulnerability was discovered in golang.org/x/image/tiff package (CVE-2024-24792) that allows parsing of corrupt or malicious images with invalid color indices, which can subsequently cause a panic. The issue was identified and reported on May 23, 2024, affecting versions before v0.18.0 (Go Issue, Go Vuln).

The vulnerability exists in the TIFF image parsing functionality where the parser accepts images with invalid color indices without proper validation. When these invalid indices are later accessed through the (*Paletted).At method, it results in an index out of range panic. The issue specifically occurs when the color indices in the image exceed the actual palette size (Go Issue).

When exploited, this vulnerability can cause application crashes through panic conditions when attempting to process malformed TIFF images. This affects applications that use the golang.org/x/image/tiff package for image processing (Go Vuln).

Users should upgrade to golang.org/x/image/tiff version v0.18.0 or later, which includes the fix for this vulnerability. The fix implements proper validation of color indices against the palette size before calling img.SetColorIndex (Go Vuln).