{"id":"EUVD-2023-2491","enisaUuid":"aeea0891-0b9b-35e0-a096-151ec6dd3996","description":"blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.","datePublished":"Sep 19, 2023, 2:57:16 PM","dateUpdated":"Sep 24, 2024, 6:56:15 PM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57h2\n","aliases":"CVE-2023-42447\nGHSA-cxvp-82cq-57h2\n","assigner":"GitHub_M","epss":0.62,"enisaIdProduct":[{"id":"4d9306e2-a0ad-3220-80aa-c57a13afa2e1","product":{"name":"blurhash-rs","vendor":{"name":"whisperfish"}},"product_version":"\u003d 0.1.1"}],"enisaIdVendor":[{"id":"507d7f06-5267-394a-a39b-c6d15aa02741","vendor":{"name":"whisperfish"}}],"enisaIdVulnerability":[{"id":"985e9773-8c13-3119-ae4f-05826a5826eb","vulnerability":{"id":"CVE-2023-42447","description":"blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.","datePublished":"Sep 19, 2023, 2:57:16 PM","dateUpdated":"Sep 24, 2024, 6:56:15 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57h2\n","enisa_id":"EUVD-2023-2491\n","assigner":"GitHub_M","epss":0.62,"dataProcessed":"Oct 31, 2026, 7:15:39 AM","vulnerabilityProduct":[{"id":"0be2cb4a-131c-40b2-a84b-31a3a9a17a6f","product":{"name":"blurhash-rs","vendor":{"name":"whisperfish"}},"product_version":"\u003d 0.1.1"},{"id":"910a09ee-622f-3ca6-b00c-231ed51bad8a","product":{"name":"blurhash-rs","vendor":{"name":"whisperfish"}},"product_version":"\u003d 0.1.1"}],"vulnerabilityVendor":[{"id":"adeb283a-d7b9-3920-9d0b-6f64c511f7a2","vendor":{"name":"whisperfish"}}]}},{"id":"9902e2a5-0ab2-3004-bfb9-64fc5f8e81cf","vulnerability":{"id":"GHSA-cxvp-82cq-57h2","description":"blurhash panics on parsing crafted inputs","datePublished":"Sep 21, 2023, 5:10:22 PM","dateUpdated":"Sep 21, 2023, 5:10:22 PM","baseScore":null,"references":"https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57h2\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-42447\nhttps://github.com/whisperfish/blurhash-rs\nhttps://github.com/whisperfish/blurhash-rs/releases/tag/v0.2.0\n","enisa_id":"EUVD-2023-2491\n","aliases":"GHSA-cxvp-82cq-57h2\nCVE-2023-42447\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:07:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}