KnowSafe 安全预警：jasper_project jasper 堆缓冲区溢出

KnowSafe 安全预警：KnowSafe 安全团队监测到编号 AVD-2020-27828 的安全漏洞（危害等级：高危）已公开披露，相关用户应尽快排查并完成修复。

漏洞介绍

There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.

影响范围

应用：jasper_project jasper（影响面 Up to (excluding) 2.0.23）

系统：alma_linux_8 jasper-libs（影响面 Up to (excluding) 2.0.14-5.el8）

系统：amazon_2 jasper（影响面 Up to (excluding) 1.900.1-33.amzn2.0.1）

系统：amazon_AMI jasper（影响面 Up to (excluding) 1.900.1-21.12.amzn1）

系统：fedora_32 jasper（影响面 Up to (excluding) 2.0.24-1.fc32）

系统：fedora_33 jasper（影响面 Up to (excluding) 2.0.24-1.fc33）

系统：opensuse_Leap_15.2 jasper（影响面 Up to (excluding) 2.0.14-lp152.7.6.1）

系统：oracle_8 jasper-libs（影响面 Up to (excluding) 2.0.14-5.el8）

……另有 4 项受影响环境，详见官方公告

解决方案

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考信息

https://bugzilla.redhat.com/show_bug.cgi?id=1905201

https://github.com/jasper-software/jasper/issues/252

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COBEVDBUO3QTNR6YQBBTIQKNIB6W3MJ2/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EBZZ2SNTQ4BSA6PNJCTOAKXIAXYNNF6V/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/

KnowSafe 将持续跟踪该漏洞的利用情况与修复进展，如需漏洞管理与应急响应支持，欢迎联系 KnowSafe 安全团队。