imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
What to do
- Upgrade to a fixed version: github.com/imgproxy/imgproxy/v3 4.0.16, github.com/imgproxy/imgproxy/v2 4.0.16, github.com/imgproxy/imgproxy 4.0.16.
- Redeploy and restart long-running processes so they load the fixed code.
Affected packages
github.com/imgproxy/imgproxy/v3
- >= 4.0.0, < 4.0.16
- 4.0.16
Check your project: go list -m all | grep github.com/imgproxy/imgproxy/v3
github.com/imgproxy/imgproxy/v2
- >= 4.0.0, < 4.0.16
- 4.0.16
Check your project: go list -m all | grep github.com/imgproxy/imgproxy/v2
github.com/imgproxy/imgproxy
- >= 4.0.0, < 4.0.16
- 4.0.16
Check your project: go list -m all | grep github.com/imgproxy/imgproxy
What changed
Published in the GitHub Advisory Database as critical.