Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-25112

CVE-2024-25112:
Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-25112
GHSA ID
GHSA-crmj-qh74-2r36
EPSS Score
0.02102%
CWE
CWE-400
Published
10/17/2024
Updated
10/23/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
exiv2pip>= 0.16.0, < 0.16.10.16.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. All vulnerability descriptions explicitly name QuickTimeVideo::multipleEntriesDecoder as the vulnerable function
  2. The GitHub commit diff shows this function was introduced in quicktimevideo.cpp via PR #2337
  3. The CWE-674 (Uncontrolled Recursion) classification directly maps to recursive function calls without proper termination conditions
  4. The vulnerability manifests when processing malicious video files, which aligns with this decoder function's purpose
  5. Version timeline matches - introduced in v0.28.0 and patched in v0.28.2

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * **ni*l-o*-s*rvi** w*s *oun* in *xiv* v*rsion v*.**.*: *n un*oun*** r**ursion **n **us* *xiv* to *r*s* *y *x**ustin* t** st**k. T** vuln*r**l* *un*tion, `Qui*kTim*Vi**o::multipl**ntri*s***o**r`, w*s n*w in v*.**.* (s** *ttps://*it*u*.*om/

Reasoning

*. *ll vuln*r**ility **s*riptions *xpli*itly n*m* Qui*kTim*Vi**o::multipl**ntri*s***o**r *s t** vuln*r**l* *un*tion *. T** *it*u* *ommit *i** s*ows t*is *un*tion w*s intro*u*** in qui*ktim*vi**o.*pp vi* PR #**** *. T** *W*-*** (Un*ontroll** R**ursion