Executive brief
Canvas is a Node.js library used to render graphics and manipulate images on the server side. Versions prior to 1.6.10 can crash when processing malicious JPEG or GIF files, causing service outages for applications that depend on this library for image handling.
Technical details
Canvas versions before 1.6.10 contain an unhandled error condition in JPEG and GIF image processing that allows an attacker to supply a malicious image file causing the Node.js process to crash. The vulnerability is triggered by processing untrusted image files without proper error handling, and can be exploited by any user able to upload or provide images to an application using the library. The attack vector is network-based if images are sourced from external input. A fix was implemented in version 1.6.10 to prevent JPEG errors from terminating the process.
Affected products
- Automattic canvas prior to 1.6.10
Timeline
- 2019-06-05: disclosed
- 2019-06-05: patched: version 1.6.10 released